docs: setup-instance step 15 names --no-push for a local-only first publish; gates.md and a docstring follow #159

Files changed:
- CHANGES.md
- VERSION
- instructions/gates.md
- instructions/setup-instance.md
- tools/chemenu/commands/git_publish.py

instructions/gates.md

@@ -139,8 +139,8 @@ deletes the material and keeps only the reason and a sha256 in `mcp-upload/ledge
 
 `upstream merge` (a private instance taking a stack update - see
 [private-instance.md](private-instance.md)) can update or delete dozens of stack-owned paths in
-one commit, and the Mass-Update Gate does not see any of it. The gate counts *working-tree*
-changes before `publish` stages them; by the time `upstream merge` commits, the change is
+one commit, and the Mass-Update Gate does not see any of it. The gate counts the *uncommitted*
+changes `publish` is about to stage; by the time `upstream merge` commits, the change is
 already history, and the commit it made is not what a later `publish` would be staging - that
 publish sees only whatever this session adds on top. A merge touching 200 files therefore goes
 out ungated the moment it is pushed.

instructions/setup-instance.md

@@ -302,6 +302,9 @@ and ready for its first ingest.
     `--confirm <token>` line that publishes once they approve. Details on the gate:
     [gates.md](gates.md).
 
+    A local-only instance (step 4) adds `--no-push` here too. Without it the call ends with exit
+    1 before the gate, because there is no remote to publish to, and commits nothing.
+
 16. **Restart the agent session.** Harnesses read the skill directories at startup; only
     afterwards are `wiki-ingest`, `wiki-query`, `wiki-manage`, `wiki-lint`, `wiki-status` and
     `gtd-weekly-review` available.