feat(FN-269): CI QA gate workflow + memory policy

Commits merged:
- feat(FN-269): complete Step 1 — CI QA gate workflow + memory policy

Files changed:
.fusion/memory/MEMORY.md      | 10 ++++++++
 .github/workflows/qa-gate.yml | 58 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+)

Fusion-Task-Id: FN-269

.fusion/memory/MEMORY.md

@@ -41,6 +41,16 @@ Highlights to remember:
 - **External integration timeouts** (PL24, EMEX, PartsCatalogs, iyzico) are not always our bug. Vendor incidents go in `vendor-incidents` memory namespace and may suppress related auto-fix tasks during the outage window.
 - **Migrations on dev** still need human ack — even though dev is staging, schema changes can desync persisted state across the team's local environments.
 
+## Pre-Merge QA Gate (active 2026-05-12)
+
+Policy: No P0 or P1 task may be marked "done" without:
+1. A passing regression test for the affected surface (`pnpm test` for affected app)
+2. A QA review document with reproduction steps, acceptance checks, and signoff timestamp
+
+Enforcement: GitHub Actions `qa-gate.yml` blocks merge if tests fail. Task-level check is manual until Fusion supports automated document verification.
+
+Non-P0/P1 tasks: Recommended but not required.
+
 ## Context
 
 - **Deploy:** Auto on push to `dev` (→ dev.sase.tr) and `main` (→ sase.tr). Both webhooks live on `git.semih.ai/root/sase.tr` and call Coolify's `/api/v1/deploy?uuid=...&force=true`. No PM2 / GitHub Actions in the loop anymore — the CLAUDE.md mention of `GitHub Actions → SSH → PM2` is historical; current deploy is Coolify-driven.