Fold gate blocked-ness into turn state so the stall watchdog sees it

[TheGreatAxios]

Summary

• Turn state now carries a blockedGateCount, incremented the moment a permission/operator gate is raised (queued or already displayed) and decremented when it resolves, driven off the gate-wire lifecycle rather than shell.overlayKind.
• paintPhase and the stall watchdog now both read bag.turn.status directly — the local, paint-only "blocked" derivation is gone, so the exemption reaches the watchdog instead of stopping at the painter.
• wireGates accepts optional GateLifecycleHooks (onGateOpened / onGateClosed), wired in product-host.ts to bridge.gateOpened() / bridge.gateClosed().
• A gate's count now survives a turn boundary (interrupt, or the turn simply settling) instead of being reset to zero, since interrupting/settling never closes the overlay itself — losing count of a still-open gate let its eventual close land against an unrelated later turn, either dropping that turn's own exemption early or reviving a settled turn's status back to "running". Terminal statuses (done/stopped/failed) are left alone when carrying the count forward, since they already satisfy the watchdog's status !== "running" exemption on their own.
• Deduplicated the once-guarded resolve wrapper shared by onPermission/onOperator in gate-wire.ts into a single onceClosed helper.

Rebase onto main (CL-5641 + CL-5644 merged first)

Rebased onto current main after PR #383 (CL-5641, threads activeToolCalls into ShouldAbortForStallArgs) and PR #382 (CL-5644, transcript echo suppression) landed. Both are independent exemptions feeding the same silentPastThreshold check in stall-watchdog.ts: args.status !== "running" (this PR's gate exemption) is checked before activeToolCalls (CL-5641's exemption), so either one alone — or both together — keeps the watchdog from aborting. The gate-wire.ts conflicts were both non-overlapping additions (CL-5644's recordDecision/recordOperatorDecision transcript calls alongside this PR's resolve wrapper); resolved by keeping both. Added tests asserting the combined behavior (gate open + active tool call together, and each alone) since neither PR's own tests covered the interaction.

Test plan

• turn-state.test.ts: pure unit coverage for turnStateGateOpened / turnStateGateClosed, nested (two outstanding) gates, and two regression tests for the cross-turn-boundary leak (gate open across an interrupt-then-resubmit, and a stale gate closing after the turn already settled).
• turn-monitor.test.ts: stall-watchdog integration tests — a gate open for 20 minutes causes no abort/notice, a gate that is merely queued (not reflected in shell.overlayKind) gets the same exemption, and a gate open alongside a live sibling tool call stays exempt through both the open and the close.
• stall-watchdog.test.ts: pure-function coverage that the gate exemption and the parallel-tool-call exemption each hold alone and together.
• Full suite green through the project's mutex-wrapped bun run test.

Review

Went through greybeard, gaasbot, critique, bruckheimer, and neckbeard. Critique and greybeard independently caught a real cross-turn leak in the first pass (the counter reset to zero on every turn-ending transition, letting a still-open gate's later close land against an unrelated turn); fixed and both re-approved after re-review. Neckbeard's one legitimate finding (duplicated once-guarded resolve wrapper) is applied. Bruckheimer confirmed no other blocking-on-human surface in the TUI exists outside gate-wire.ts that would need the same wiring.

[linear-code]

CL-5642