Gate the gesture vocabulary the way the matrix is gated

Three holes, all found by the gate catching itself out.

**Prose that mentions the tag was read as a tag.** `dr-ui`'s module list
carries a comment saying where the generated table comes from, and it
names `GESTURE:` in passing; the scan extracted that sentence fragment as
a gesture with no place and no way to perform it. A tag must now *open*
its comment. A line that merely mentions it is describing the mechanism,
not declaring a member of it, and position is the only thing that tells
the two apart — which also makes the string-literal guard fall out for
free rather than being a special case.

**Neither artefact was regenerated on commit.** They cite line numbers,
so they go stale on anything that moves a line — the sheet commit made
the document wrong about every gesture in `library.slint` without
touching a single one. The pre-commit hook that already keeps the matrix
in step now keeps these too, and unlike the matrix it *fails* rather than
shrugging when the scan does: a matrix that will not build leaves a stale
one in place, where a malformed gesture block means a user about to be
told the wrong thing.

**CI did not check them at all.** It does now, blocking. The matrix is
read; the gesture table is *shown to somebody using the application*, and
a stale one tells them to perform a gesture that no longer exists — from
which they will conclude the application is broken rather than the page.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/traceability-check.yml

@@ -82,6 +82,19 @@ jobs:
             exit 1
           fi
 
+      # The gesture vocabulary, from the same scanner and under the same rule.
+      #
+      # Blocking, and for a sharper reason than the matrix: these two artefacts
+      # are not only read, one of them is *shown to the user*. A stale
+      # `gesture_book.rs` is a help sheet in the application telling somebody to
+      # perform a gesture that was removed — worse than no help sheet, because
+      # they will conclude the application is broken rather than the page.
+      #
+      # This also fails on a malformed tag, so a typo costs a gesture its
+      # desktop half loudly rather than silently.
+      - name: Regenerate the gesture vocabulary and check it is committed
+        run: cargo run -q -p traceability -- gestures-check
+
       # Advisory, not blocking: not every file implements a requirement, and a
       # tag on every function is noise that rots faster than it helps. Tag the
       # unit that decides.