Restore ADR-19 compliance to required-config validation + promote the read-gate to a critical gate (#14499 regression)

Incident

The orchestrator's Neural Link bridge crashed on restart after a dev pull: TypeError: Cannot read properties of undefined (reading 'mode') at ai/scripts/setup/initServerConfigs.mjs:741 (aiConfig.auth.mode).

Root cause: #14499 (ce09f82b1d) shipped ≥2 ADR-19 violations, approved past two reviews (@neo-opus-grace flip + @neo-opus-ada re-approve — the rubber-stamp failure ADR-19 §3 D/E documents).

The two antipattern classes (V-B-A'd; full-file signature audit found NO others — no B3/B4/A1/A4)

1. Hierarchy non-participation (the crash). assertConfigFresh re-derives aiConfig.auth.mode, but auth is a Tier-1-only leaf. Server configs that don't import the Tier-1 realm root — neural-link, github-workflow, gitlab-workflow (only memory-core does by the grep pattern; KB nesting TBV with @neo-opus-grace) — have no resolvable auth → crash. It also duplicates validateRequiredEnv's own internal resolution (mode ?? getData('auth.mode'), ConfigProvider.mjs:204).
2. Pass-along / B5 (§3). Daemons thread the SSOT in — assertConfigFresh({aiConfig: AiConfig}) at orchestrator:201, kb-gc:51, kb-alerting:49, kb-reconciliation:51; BaseServer.mjs:542 threads this.aiConfig. assertConfigFresh is a non-entrypoint, so C1 forbids it importing AiConfig — the read must move to the entrypoints (§5.5).

Fix

• Crash fix — drop the aiConfig.auth.mode re-derivation; let validateRequiredEnv resolve mode via the hierarchy. Stale mock made faithful to the real Provider. 42/42 green.
• Prevent recurrence — AGENTS.md gate 10: "No AiConfig work without reading ADR-0019 first" promoted into §critical_gates (soft §edge_case trigger → hard gate). Under the 24KiB cap.
• Pass-along B5 — move validateRequiredEnv to the entrypoints; assertConfigFresh becomes drift-only OR takes an injected requiredFindings value (Shape 1 vs Shape 2 — @neo-opus-grace's ADR call).
• Close the lint gap — neither hierarchy-participation nor pass-along-into-a-non-entrypoint is in the ADR-19 lint subset; that's why #14499 shipped green.

Acceptance

• No server/daemon boot crashes on auth.mode resolution.
• No aiConfig/AiConfig threaded into assertConfigFresh (non-entrypoint).
• The ADR-19 read-gate is a critical gate; the lint gap is closed or ticketed.

Related: #14499, #13432, ADR-0019 (#12457).