Make aggregate ONNX gates execute for real

Reference-count the process-global ONNX Runtime across embedder and routing-head sessions, make close idempotent, and require named proof that both aggregate routing gates executed rather than self-skipped (V-716). Owner explicitly requested direct commits to master.

Makefile

@@ -228,11 +228,15 @@ t:
 # Verbose so the report tables land in the terminal. MAVEN_ONNX_LIB points the
 # prod-representative baseline at the vendored runtime; override it or set it
 # empty to run only the deterministic hash ratchet. This is the measurement
-# Vikunja #319 compares before #320 flips the route decider.
+# Vikunja #319 compares before #320 flips the route decider. With a non-empty
+# runtime path the package must prove that at least two model gates executed;
+# a constructor skip after the first process-global initialization is a failure.
 MAVEN_ONNX_LIB ?= $(shell pwd)/deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so
 
 eval-router:
-	MAVEN_ONNX_LIB="$(MAVEN_ONNX_LIB)" $(GO) test -v -count=1 ./internal/router/eval/
+	MAVEN_ONNX_LIB="$(MAVEN_ONNX_LIB)" \
+	MAVEN_ONNX_REQUIRED_GATES="$(if $(MAVEN_ONNX_LIB),2,0)" \
+		$(GO) test -v -count=1 ./internal/router/eval/
 
 # eval-reach — score the held-out ecosystem reach fixture (internal/router/eval,
 # ru_ecosystem_v1.json). Answers "does a real Russian utterance actually arrive