fix(merge-gate): SHA-in-main as sole merge-verify criterion + main regression guard

Root-cause fix for main erosion (phantom merge): code of ORCH-067/069 reached
`done` while absent from origin/main (only their auto docs-PRs landed).

- FR-1: verify_merged_to_main confirms merge ONLY by `git merge-base
  --is-ancestor <validated_sha> origin/main`; the OR-branch pr_already_merged is
  removed (a merged PR no longer confirms). Empty SHA / git error -> False.
- FR-2: pr_already_merged demoted to merge_pr idempotency-guard; counts a PR only
  when merged & head.ref==<branch> & base.ref=="main" (explicit in-loop filter).
- FR-3: merge_pr selects the open code-PR by head==<branch> AND base==main.
- FR-5: new deterministic check_main_regression in _handle_merge_verify (after
  confirmed SHA-in-main, before done) verifies MAIN_REGRESSION_MARKERS still in
  origin/main; deterministic count==0 -> alert "main regressed" + HOLD (NOT done,
  no rollback); git error of the grep -> fail-open. Kill-switch
  ORCH_REGRESSION_GUARD_ENABLED; non-self -> no-op.
- FR-4: root .gitattributes `CHANGELOG.md merge=union` so Unreleased edits
  auto-merge on rebase without conflict (branch not rolled back).

Invariants unchanged (STAGE_TRANSITIONS, QG_CHECKS, deploy-status, merge-gate,
image-freshness, DB schema, external HTTP API); non-self repos no-op (INV-5);
never-raise (INV-1); merge only via Gitea PR-API (INV-2).

Docs: CHANGELOG, .env.example (README/ADR updated by architect). Tests:
tests/test_orch073_*.py (TC-01..18); existing merge-gate tests updated for the
new code-PR filter.

Refs: ORCH-073

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/config.py

@@ -396,6 +396,19 @@ class Settings(BaseSettings):
     merge_pr_timeout_s: int = 60
     merge_verify_timeout_s: int = 60
 
+    # ORCH-073 (ADR-001 Р-4): main-integrity regression guard. After the merge-verify
+    # under-gate confirms the deployed SHA is an ancestor of origin/main (FR-1), a
+    # secondary deterministic (no-LLM) guard checks that a declarative set of markers
+    # for recently-merged tasks (MAIN_REGRESSION_MARKERS in merge_gate.py) is still
+    # present in origin/main — i.e. a CHANGELOG-rebase or phantom-merge did not silently
+    # roll back a neighbouring task's code. A missing marker (deterministic count==0) ->
+    # ALERT + HOLD (task stays on `deploy`, NOT done); an infra/git error on the grep
+    # itself -> fail-OPEN (do not block done; SHA-in-main remains the primary gate).
+    #   regression_guard_enabled -> kill-switch (env ORCH_REGRESSION_GUARD_ENABLED);
+    #                               reuses the merge_verify_applies scope (self-hosting /
+    #                               merge_verify_repos), so non-self repos are a no-op.
+    regression_guard_enabled: bool = True
+
     # Telegram notifications
     telegram_bot_token: str = ""
     telegram_chat_id: str = ""