docs: correct git-gate status on macOS backend (not deferred)

git-gate is fully implemented on the macos-container backend via the
gateway's consolidated git-http daemon with dynamic key
provisioning/revocation; only the legacy per-bottle git:// daemon is
unused. Fixes a stale README claim that git-gate is "deferred" and
removes the PRD open-question built on that false premise (sandbox-escape
attack 5 runs the same on macOS as on the other backends).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/prds/prd-new-macos-container-ci-runner.md

@@ -131,10 +131,10 @@ the backend launches — the very false-green this issue is about.
 
 ## Open questions
 
-- Some sandbox-escape attacks depend on `bottle.git` / git-gate, which is
-  intentionally deferred on the macOS backend until a safe Apple Container
-  key-delivery path exists. First runner bring-up may reveal individual attacks
-  that need a `skipUnless` guard for `macos-container`. This does not affect the
-  infra-regression signal (that fails at `setUpClass`/launch, before any
-  attack), but it is expected first-run shakeout and is left to the bring-up
-  PR that actually has the runner in hand.
+- None known that block the job. git-gate is fully implemented on the macOS
+  backend (the gateway's consolidated `git-http` daemon plus dynamic key
+  provisioning/revocation), so `TestSandboxEscape` attack 5 — secret exfil
+  pushed through git-gate, rejected by the gitleaks hook before the upstream
+  push — runs the same as on the other backends. Any genuinely
+  macOS-specific test adjustment would surface at first runner bring-up, but
+  none is anticipated from the current backend implementation.