cross-vendor-trust-gate

Run the skill-factory final trust gate: operate trust-gate.sh, read skill.trust.json, and enforce --require-cross.