docs: explain ci gate semantics

[luohui1]

Summary

• document the four independent CI gate types in the CI integration guide
• clarify that category gates and the --ci preset use different scoring paths
• mention the inclusive category boundary and permissions:1 recommendation for fail-on-any-risk policies
• update --ci help text and cover it with a focused CLI help test

Fixes #210

Type of change

• Bug fix
• New feature / analyzer
• Breaking change
• Documentation

Test plan

• uv run pytest tests\test_category_gates.py tests\test_cli_output_parity.py
• uv run ruff check src tests
• git diff --check
• Manual CLI test (if applicable)

  uv run mcts scan --help

Checklist

• CHANGELOG.md updated (if user-facing) — see Keep a Changelog
• Tests added or updated
• No secrets or credentials in code
• Docs updated if CLI behavior or report output changed — see Documentation index (guides live under docs/get-started/, docs/scanning/, docs/platform/, etc.)