fix(gateway): role-gate ContentActions.commit (developers + documenters only)

Smoke 2026-05-03 saw main-pm reach the git layer with a 'commit' call,
trying to author 'fix(gateway): allow claimed status in i_will_plan
preflight'. That should never have been possible — main_pm/cell_pm/
board/auditor/qa manifests all exclude commit. Reaching the verb body
means either the MCP manifest filter mis-routed, or the agent hit the
v2 do.py route directly.

Mirror Task 16 notify pattern: server-side role check in the verb body
rejects with not_authorized + 'PMs delegate, do not commit' remediate.
Defense-in-depth — manifest is still the primary gate.

tests/unit/gateway/test_content_actions_ownership.py

@@ -28,6 +28,11 @@ def _make_deps(**overrides: AsyncMock) -> ContentActionsDeps:
         task = AsyncMock()
         task.get_active_task_for_agent.return_value = None
 
+    # commit() now checks caller role; default to developer.
+    from unittest.mock import MagicMock
+
+    task.agent_for.return_value = MagicMock(role="developer")
+
     if "git" in overrides:
         git = overrides["git"]
     else: