fix: upstream merge - preserve gitignored local data, refuse a merge git never opened (4.5.0-beta.3, #30)

Files changed:
- CHANGES.md
- VERSION
- docs/ownership-and-templates.md
- instructions/gates.md
- instructions/private-instance.md
- tools/CONTRACT.md
- tools/chemenu/commands/upstream_cmd.py
- tools/chemenu/tests/test_upstream_cmd.py

instructions/gates.md

@@ -117,9 +117,11 @@ This is not a hole to patch by making `upstream merge` route through the gate: t
 question ("is this too much to publish?") does not apply to a change that only ever touches
 stack-owned paths that are, by definition, not this instance's own content. The check that
 actually matters here is `upstream merge`'s own postcheck - it re-verifies the merge commit
-against `upstream verify`'s logic immediately after committing, and refuses loudly (uncommitted
-state is not rolled back; the commit is left for a human to look at) if anything landed outside
-a stack-owned path. That is the safeguard for this command, not the Mass-Update Gate.
+against `upstream verify`'s logic immediately after committing, and exits 1 with the offending
+paths if anything landed outside a stack-owned one. **The merge commit is deliberately left in
+place** rather than reverted: it exists, a human has to look at it, and a command that quietly
+repaired its own mistake would hide the one event worth seeing. That postcheck is the safeguard
+for this command, not the Mass-Update Gate.
 
 ## Iteration Budget Gate and loop-breaker