feat(content): obligate role note sections like journals

Completes the note(scope='handoff') write-path (WIP 23e6ee57): every role
with a dedicated note section is now obligated to populate it, the same way
journals are obligated.

Obligations (foundation.policy.tracing):
- DEV_NOTES / PR_REVIEWER_NOTES / QUICK_CONTEXT_MIN_CHARS requirements +
  checkers, wired onto i_am_done (dev_notes), delegate (quick_context), and
  pr_pass / pr_fail / post_pr_review (pr_reviewer_notes).
- Fixes a latent bug: the docs-notes checker read dev_notes instead of
  doc_notes (the documenter's section); the i_documented shim now feeds
  doc_notes to match.

Auditor: a session-scoped note obligation on i_am_idle — the auditor owns no
delivery task and has no delivery verb, so it must have recorded an
observation within the window before going idle (JournalService.has_recent_entry).

Write-then-gate: persisted sections (dev_notes / quick_context) are
pre-written by the agent's note(scope='handoff') before the gated verb;
argument-borne sections (doc_notes / pr_reviewer_notes) are checked through a
SimpleNamespace shim, the same pattern qa_notes already uses.

Config: dev/pr_reviewer/quick_context min-chars (40/40/30), panel-tunable.
Plus per-gap remediation hints and full coverage (write-path routing,
ownership, validation->remediation, each obligation, the doc_notes fix).

Full make-quality green: 9777 passed, 95.6% coverage.

tests/unit/gateway/test_auditor_idle_note_guard.py

@@ -0,0 +1,81 @@
+"""Tests for the auditor's i_am_idle note obligation (_auditor_note_guard).
+
+Every role with a dedicated note section is obligated to populate it, like
+journals. The auditor owns no delivery task and has no delivery verb, so its
+obligation is session-scoped: it must have recorded an observation within the
+window before it may go idle. Inert for every other role.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+from unittest.mock import AsyncMock, MagicMock
+from uuid import uuid4
+
+import pytest
+from roboco.services.gateway.choreographer import Choreographer, ChoreographerDeps
+
+
+def _make_deps(**overrides: Any) -> ChoreographerDeps:
+    base: dict[str, Any] = {
+        "task": AsyncMock(),
+        "work_session": AsyncMock(),
+        "git": AsyncMock(),
+        "a2a": AsyncMock(),
+        "journal": AsyncMock(),
+        "audit": AsyncMock(),
+        "evidence_repo": AsyncMock(),
+    }
+    base.update(overrides)
+    return ChoreographerDeps(**base)
+
+
+@pytest.mark.asyncio
+async def test_auditor_idle_blocked_without_recent_observation() -> None:
+    """An auditor with no recent journal entry is refused idle."""
+    auditor_id = uuid4()
+    task_svc = AsyncMock()
+    task_svc.agent_for.return_value = MagicMock(role="auditor", team="board")
+    journal = AsyncMock()
+    journal.has_recent_entry.return_value = False
+    c = Choreographer(_make_deps(task=task_svc, journal=journal))
+
+    guard = await c._auditor_note_guard(auditor_id, briefing={})
+
+    assert guard is not None
+    body = guard.as_dict()
+    assert body["error"] == "invalid_state"
+    assert "auditor_notes" in body["message"]
+    assert "note(scope='reflect'" in body["remediate"]
+    # The window query was actually consulted.
+    journal.has_recent_entry.assert_awaited_once()
+
+
+@pytest.mark.asyncio
+async def test_auditor_idle_allowed_with_recent_observation() -> None:
+    """An auditor that recorded an observation recently may idle."""
+    auditor_id = uuid4()
+    task_svc = AsyncMock()
+    task_svc.agent_for.return_value = MagicMock(role="auditor", team="board")
+    journal = AsyncMock()
+    journal.has_recent_entry.return_value = True
+    c = Choreographer(_make_deps(task=task_svc, journal=journal))
+
+    guard = await c._auditor_note_guard(auditor_id, briefing={})
+
+    assert guard is None
+
+
+@pytest.mark.asyncio
+async def test_idle_note_guard_inert_for_non_auditor() -> None:
+    """A developer never trips the auditor guard (no journal lookup at all)."""
+    dev_id = uuid4()
+    task_svc = AsyncMock()
+    task_svc.agent_for.return_value = MagicMock(role="developer", team="backend")
+    journal = AsyncMock()
+    c = Choreographer(_make_deps(task=task_svc, journal=journal))
+
+    guard = await c._auditor_note_guard(dev_id, briefing={})
+
+    assert guard is None
+    journal.has_recent_entry.assert_not_awaited()