Make aggregate ONNX gates execute for real

Reference-count the process-global ONNX Runtime across embedder and routing-head sessions, make close idempotent, and require named proof that both aggregate routing gates executed rather than self-skipped (V-716). Owner explicitly requested direct commits to master.

docs/qa.md

@@ -301,6 +301,23 @@ make eval-recall
 
 A large miss against 72.7% means the deploy differs from the bench harness.
 
+`make eval-router` is also the aggregate ONNX lifecycle gate. When the default
+runtime path is non-empty it requires both `TestONNXBaseline` and
+`TestONNXRoutingHeads` to load their models and execute in the same Go process.
+The final line names both verified gates. A later test that skips because the
+first one consumed the process-global runtime now makes the command fail rather
+than leaving a green package result. To exercise the proof directly:
+
+```sh
+MAVEN_ONNX_LIB="$PWD/deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so" \
+MAVEN_ONNX_REQUIRED_GATES=2 \
+  go test -v -count=1 \
+  -run '^(TestONNXBaseline|TestONNXRoutingHeads)$' ./internal/router/eval/
+```
+
+Set `MAVEN_ONNX_LIB=` explicitly when the intended measurement is the portable
+hash floor; that also disables the aggregate ONNX requirement.
+
 **Run on 02-08-2026 @ af9d213. The deploy matches the bench.** `eval-models`
 scored 56 of 77: 72.7% full, 77.9% intent-only, 2 false clarifies and 1 missed.
 That is the recorded figure to the decimal, and calendar sat at 2 of 2, so the