v0.13.38: @newsroom.writer: where a check runs

Where a check runs is part of the policy: tests as enforcers of Agent Behaviour Policies, and what moving them out of the agent's environment would gain, measured on this newsroom.

• Today, measured. 435 seconds on the agent's machine and 324 in CI; 19 of 57 checks stop a deploy.
• Moved, estimated. 49 checks gating in CI, 7 with the agent, about a third less time per release.
• The rule. A check moved out of the agent's environment improves security only if the new place is a gate; CI is a boundary only once the platform protects it.
• What it takes. The voice and summaries pass on all content today; wording and graphs need a small clean-up; the rebuild and two live tests need work.