A base-owned post-rig gate sweep row, so a rig gate can re-block

extract-animated-character shipped rig-aware gate participation: a domain declaring rigSteps is not due until its rig track begins, so the plugin-gates sweep (FINAL scope, before rig) no longer fires the rigging gate a phase early. The cost, stated in that change's design D1: in the normal flow the sweep never re-runs after the rig track, so a rig gate's blocking declaration is inert — the check still runs (the rig-gates checklist step invokes the same tool, agent-read), but nothing machine-enforces it.

Both reviewers named the better end state: a base-owned checklist row appended after the rig scope that re-runs the gate sweep. It must be base-owned — domains' _ALLOWED deliberately has no finalSteps key so a plugin can never change what runs at the terminal phase. When this lands, plugin-character's rigging gate can return to blocking: true (its own re-block trigger — the four producer-less checks gaining producers — permitting).

Refs: plugin-character extract-animated-character design D1; run_gates.py rig-aware participation (9be01f8).