fix(ci): make every manual gate default to a value that matches nothing (#158)

## Problem

A manual `crow pipeline create` instantiates **every** file in `.crow/`, and a declared variable default is applied even when the run never passed that variable. A gate is therefore only a gate if its default matches nothing.

#155 fixed the three pipelines that had no manual gate at all. It missed that a *permissive default* leaves a pipeline just as exposed. Demonstrated the expensive way: creating a pipeline with only

```
--var weekly_audit_missing=alpine-324-amd64
```

also started `build-all-versions` — because its gate `target_arch` defaults to `amd64`, which matches its own amd64 matrix rows — and `process-updates` across every row, because that gate defaults to `all`. The run was killed before any `Upload package indexes` step produced output and both alpine324 indices were verified unchanged, but `build-all-versions` uploads binaries and rewrites indexes, so the next one might not be caught in time.

Before:

| pipeline | gate | default | fired on an unrelated manual run |
| --- | --- | --- | --- |
| `build-all-versions` | `target_arch` | `amd64` | amd64 rows — builds and uploads |
| `build-all-versions-install-deps` | `target_arch` | `amd64` | amd64 rows |
| `weekly-rebuild-missing` | `weekly_rebuild_missing` | `all` | every row |
| `weekly-audit-missing` | `weekly_audit_missing` | `all` | every row |
| `process-updates` | `process_cran_updates` | `all` | every row |
| `repair-built-stamp` | `repair_built_stamp` | `arm64` | arm64 rows |

`archive-missed-packages` was the one that behaved, because its gate variable is never declared and so matches nothing. That is the property this restores everywhere.

## What this changes

Each of the six gets a `none` option on its gate variable and defaults to it, so a manual run has to name its target explicitly. The reason is recorded next to the default, where someone would go to change it.

`none` is used rather than dropping the default so the expression always has a defined value to compare, instead of relying on undefined-variable semantics.

Cron triggers are untouched — they match on the `cron:` name, not the variable.

## Verification

`crow lint .crow/` reports all ten configs valid. Auditing every pipeline that accepts a manual event:

```
archive-missed-packages.yaml:        gate=task                    default=<none>
auto-apply-patches.yaml:             gate=auto_apply_patches      default='false'
build-all-versions-install-deps.yaml gate=target_arch             default=none
build-all-versions.yaml:             gate=target_arch             default=none
process-updates.yaml:                gate=process_cran_updates    default=none
repair-built-stamp.yaml:             gate=repair_built_stamp      default=none
trial-build-registry.yaml:           gate=trial_build_registry    default='false'
weekly-audit-missing.yaml:           gate=weekly_audit_missing    default=none
weekly-patch-proposals.yaml:         gate=weekly_patch_proposals  default='false'
weekly-rebuild-missing.yaml:         gate=weekly_rebuild_missing  default=none
```

Every gate now defaults to something that matches no matrix row.

Reviewed-on: #158

.crow/weekly-rebuild-missing.yaml

@@ -8,9 +8,13 @@
 #             single <os>-<arch> to run just one.
 # Arch placement is handled by the group label (rpkgs-amd64, rpkgs-arm64).
 variables:
+  # Gates this pipeline. A manual pipeline creation instantiates every file in
+  # .crow/, and a declared default is applied even when the run never passed
+  # this variable, so the default must be a value that matches no matrix row.
   weekly_rebuild_missing:
-    description: "Manual run target: a specific <os>-<arch>, or 'all' for every os/arch."
+    description: "Manual run target: a specific <os>-<arch>, 'all' for every os/arch, or 'none' to run nothing."
     options:
+      - none
       - all
       - alpine-322-amd64
       - alpine-322-arm64
@@ -30,7 +34,7 @@ variables:
       - ubuntu-2404-arm64
       - ubuntu-2604-amd64
       - ubuntu-2604-arm64
-    default: all
+    default: none
 
 when:
   - event: cron