feat(hooks): skip only the named delivery gates at pre-push with SCC_SKIP_CHECKS

[protonspy]

What changed

The pre-push hook gets a narrow escape: SCC_SKIP_CHECKS.

• SCC_SKIP_CHECKS=test (a comma list such as lint,test, or 1/all for all four) skips only those delivery-gate commands for one push. The artifact, attribution and pull-request validators still run.
• The hook prints a warning on stderr naming the gates it skipped, so a skipped push is never mistaken for a verified one.
• An unknown gate name (for example tests) exits 1 instead of quietly running the suite.
• When a gate fails, the hint now offers SCC_SKIP_CHECKS alongside SCC_SKIP_HOOKS=1.
• validate.WithoutGates is the option behind this. scc validate --checks and scc check do not read the variable, so CI still enforces all four gates.

Why: when a machine could not run part of the suite (for example a database it does not have), SCC_SKIP_HOOKS=1 was the only way to push, and it also turned off every other check.

Plan: plans/pre-push-skip-checks.md. Docs: docs/wiki/pages/hooks.md, README, wiki changelog.

Not done: internal/assets/templates/rules/delivery.md does not mention the variable. Changing a template requires an assets.Version bump, which is outside this change.

Verification

• scc validate --checks --pr: exit 0, 1032 tests, coverage 86.4%, 0 findings.
• New tests: TestWithoutGatesPassesOverOnlyTheNamedGates, TestPrePushSkipsOnlyTheGatesNamed, TestSkippedGatesReadsTheEnvironmentValue.
• golangci-lint run and golangci-lint fmt --diff: clean.

Reviews

• scc-code-review: clean, no findings. Minor notes: true is accepted but undocumented, and the hint matches findings by the check./tests. rule prefixes.
• scc-security-review: clean, no findings. The value is parsed against a closed set of gate names and never reaches a shell. It grants nothing beyond what SCC_SKIP_HOOKS/--no-verify already grant.

[protonspy]

Reviews recorded in the body. CI earlier failed on govulncheck stdlib findings, fixed by #60.