docs: setup-instance step 15 names --no-push for a local-only first publish; gates.md and a docstring follow #159

Files changed:
- CHANGES.md
- VERSION
- instructions/gates.md
- instructions/setup-instance.md
- tools/chemenu/commands/git_publish.py

instructions/gates.md

@@ -139,8 +139,8 @@ deletes the material and keeps only the reason and a sha256 in `mcp-upload/ledge
 
 `upstream merge` (a private instance taking a stack update - see
 [private-instance.md](private-instance.md)) can update or delete dozens of stack-owned paths in
-one commit, and the Mass-Update Gate does not see any of it. The gate counts *working-tree*
-changes before `publish` stages them; by the time `upstream merge` commits, the change is
+one commit, and the Mass-Update Gate does not see any of it. The gate counts the *uncommitted*
+changes `publish` is about to stage; by the time `upstream merge` commits, the change is
 already history, and the commit it made is not what a later `publish` would be staging - that
 publish sees only whatever this session adds on top. A merge touching 200 files therefore goes
 out ungated the moment it is pushed.