Pins the invariant behind the CRITICAL gate-delivery gap this PR fixed: a new
interrupt kind added to the pending_questions CHECK without a coordinator branch
suspends the task forever (no Slack post, no ledger row). The guard parses the
allowed kinds from PENDING_QUESTIONS_DDL (source of truth) and asserts every
non-default kind has a graph.*_KIND constant referenced in coordinator.py.
Negative-checked: removing the confluence_approval branch fails the guard.
