Align release decisions and validate governance inputs

[simaba]

What changed

• Aligns the executable policy with the framework's five documented outcomes: release, release_with_conditions, hold, do_not_release, and defer.
• Treats missing hard-gate evidence as hold instead of automatically collapsing it into a terminal rejection.
• Adds explicit decision context for critical failures, prohibited conditions, unacceptable residual risk, and owner-requested deferral.
• Rejects malformed Boolean evidence, unknown evidence/context fields, and risk inputs outside the documented 1–5 range.
• Adds 22 unit tests covering outcome semantics, precedence, input validation, CLI serialization, and risk-tier thresholds.
• Adds read-only GitHub Actions CI with SHA-pinned current action releases and Python 3.11/3.14 coverage.
• Adds basic Python project metadata and documents the CLI decision contract.

Why

The documentation defined five distinct governance outcomes, while the Python policy implemented only three. In particular, missing critical controls were emitted as no_go, which erased the distinction between a remediable hold and an explicit do-not-release decision. The policy also accepted truthy non-Boolean evidence values, which could silently turn malformed input into a passing gate.

Compatibility / behavior

• Existing JSON profile input shape remains valid because decision_context is optional.
• Legacy enum symbols (GO, CONDITIONAL_GO, NO_GO) remain available as aliases.
• The serialized decision values intentionally change to the framework vocabulary and are documented in the changelog and usage guide.

Validation

• python -m unittest discover -s tests -v: 22 tests pass locally.
• python -m compileall passes for src/ and tests/.
• Existing sample profiles were exercised: the IVI example remains release; the high-risk ADAS example now correctly evaluates to hold when hard controls are incomplete.