fix: harden review and verifier governance

scripts/secret_gate_coverage_test.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT_DIR"
+
+check_contains() {
+    local file="$1"
+    local needle="$2"
+    grep -Fq "$needle" "$file" || {
+        echo "missing in ${file}: ${needle}"
+        exit 1
+    }
+}
+
+check_contains "scripts/verify_phase6.sh" '. "$SCRIPT_DIR/secret_gate_lib.sh"'
+check_contains "scripts/verify_phase6.sh" 'secret_scan_paths . cmd internal frontend/src scripts .github/workflows && secret_env_files .dockerignore'
+check_contains "scripts/verify_phase6.sh" 'bash scripts/secret_gate_test.sh'
+check_contains "scripts/secret_gate_test.sh" '. "$ROOT_DIR/scripts/secret_gate_lib.sh"'
+check_contains "scripts/secret_gate_test.sh" 'secret_scan_paths "$SECRET_FILE" "$CLEAN_FILE"'
+check_contains "scripts/secret_gate_test.sh" 'secret_env_files "$DOCKERIGNORE_FILE"'
+
+echo "secret_gate_coverage_test: PASS"