feat(merge-gate): auto-rebase onto current main + re-test + serialise merges

Deterministic (no-LLM) sub-gate on the deploy-staging -> deploy edge that
catches a feature branch up to the CURRENT origin/main, re-tests the combined
tree, and serialises merges with a per-repo file lease — so two green parallel
branches can no longer break main (self-hosting safety for the orchestrator repo).

- src/merge_gate.py: branch_is_behind_main, auto_rebase_onto_main (push
  --force-with-lease ONLY the task branch, NEVER main), retest_branch, and a
  file merge-lease (atomic O_CREAT|O_EXCL, holder-aware release, stale reclaim).
  Strict never-raise contract; all git ops in the per-branch worktree.
- src/qg/checks.py: check_branch_mergeable composes the primitives under the
  lease; registered in QG_CHECKS. Conditional rollout (merge_gate_enabled /
  merge_gate_repos, default self-hosting only).
- src/stage_engine.py: sub-gate hook on deploy-staging (not a new stage). PASS ->
  advance; "merge-lock busy" -> DEFER (re-queue with available_at, anti-deadlock
  at max_concurrency=1, capped); conflict/red re-test -> rollback to development
  + developer retry (capped by MAX_DEVELOPER_RETRIES). Lease released on
  deploy->done / rollback / PR-merged webhook.
- src/db.py: enqueue_job(available_at_delay_s=...) for the defer (no schema change).
- src/webhooks/gitea.py: holder-aware lease release on PR-merged.
- src/config.py + .env.example: ORCH_MERGE_* settings.

Docs: README + adr-0006 (architect) already cover the design; CHANGELOG updated.
Tests: test_merge_gate.py, test_qg_merge_gate.py, test_merge_gate_race.py,
test_stage_engine.py::TestMergeGate, test_config.py, QG-registry snapshot.
Full suite: 535 passed.

Refs: ORCH-043

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/db.py

@@ -324,19 +324,34 @@ def enqueue_job(
     task_content: str | None = None,
     task_id: int | None = None,
     max_attempts: int = 2,
+    available_at_delay_s: int | None = None,
 ) -> int:
     """Enqueue a new job (status='queued'). Returns the new job id.
 
     This is what webhook handlers call instead of launching an agent in-process:
     it is a fast DB INSERT that returns immediately. The background worker
     (queue_worker) picks the job up later.
+
+    ORCH-043 (merge-gate defer): when ``available_at_delay_s`` is given the job's
+    ``available_at`` is set to ``now + delay`` so claim_next_job won't pick it up
+    until the delay elapses (re-uses the existing ORCH-1 backoff gate). Used to
+    re-queue the staging-deployer after a "merge-lock busy" defer without burning a
+    worker slot in a blocking wait.
     """
     conn = get_db()
-    cursor = conn.execute(
-        "INSERT INTO jobs (agent, repo, task_id, task_content, max_attempts) "
-        "VALUES (?, ?, ?, ?, ?)",
-        (agent, repo, task_id, task_content, max_attempts),
-    )
+    if available_at_delay_s is not None:
+        cursor = conn.execute(
+            "INSERT INTO jobs (agent, repo, task_id, task_content, max_attempts, available_at) "
+            "VALUES (?, ?, ?, ?, ?, datetime('now', ?))",
+            (agent, repo, task_id, task_content, max_attempts,
+             f"+{int(available_at_delay_s)} seconds"),
+        )
+    else:
+        cursor = conn.execute(
+            "INSERT INTO jobs (agent, repo, task_id, task_content, max_attempts) "
+            "VALUES (?, ?, ?, ?, ?)",
+            (agent, repo, task_id, task_content, max_attempts),
+        )
     job_id = cursor.lastrowid
     conn.commit()
     conn.close()