Direct landing honours the auto-merge stop, including a stop left from PR mode across a land_mode switch #808

Outcome: the auto-merge stop (the stop file, or the policy's off switch) holds in direct landing mode too. A direct land, approved or not, never lands while the stop is set, and the stop survives a land_mode switch with its meaning intact.

Why (from #715 / PR #805's round-1 review, issuecomment-6262008907):

• Direct-mode landing never checked the auto-merge stop (inferred, from the code). Only PR mode writes the stop: main watch is off in direct mode (merge-flow.ts:~978), and fix-forward only follows a PR merge.
• A stop left from PR mode survives a dashboard land_mode switch to direct, and is then ignored (inferred).
• Principle 2 (owner, 2026-10-19): turning anything OFF must work on every surface. Nothing can block it, and no mode switch can bypass it.
• Also from that review: writing events.db directly with sqlite can forge decision.answered. File modes cover it today (inferred). Say whether that's acceptable, or add a check.

Do:

1. Direct landing checks the stop immediately before it lands, the same check PR mode uses.
2. A test: a stop set in PR mode, then a switch to direct mode, then an approved direct land, refuses to land. It must fail on main.
3. Document it in docs/design.md and the CHANGELOG.

Constraints:

• Fail closed.
• Nothing reopens a route.
• Turning auto-merge off can't be blocked.

Review point: L3 (landing and the merge policy). Protected; the owner merges.

Related: #715, #805, #726.