P9 option 4: advisory gate reads a pinned RustSec snapshot on the merge path (gate content, one-way) #6110

Operator ruling 2026-10-19 14:10 Madrid (P9 option 4). Rebuild of PR #5760 on main after #5908 (advisory diff gate). Merge path scans against a pinned advisory-db (ci/advisory-db.pin); a pin not verified in 7 days is red (F5); daily bump (F7); live audit stays on advisory-andon. Gate-class, one-way door; no merge before the operator word.