Gate publication in three levels

First half of Phase 5, and the security-relevant core of it. The security model
defines hard block, overridable soft block, and clear; nothing implemented them,
so readiness collapsed every concern into one boolean where incomplete evidence
and confirmed danger looked identical.

PublicationGate evaluates a readiness assessment, findings, host capability, and
preview outcome into a content-addressed PublicationDecision. A verified secret
or an unacknowledged critical vulnerability is a hard block that accept_override
refuses outright. Incomplete scanner coverage, a failed preview, a missing
execution plan, or an unverified build is a soft block, clearable by an explicit
human decision that records exactly which codes it covers so the pull request
can name what was skipped.

A host with no container runtime is a soft block rather than a refusal.
Refusing there would put deployment out of reach for anyone unable to install a
runtime without making any project safer, which is the tradeoff the roadmap's
delivery tracks exist to preserve.

Reasons sort strongest first, so a reader sees a refusal before the noise, and
evaluation is deterministic so a digest can bind the decision.

Author: bananatruck

crates/launchguard-core/src/error.rs

@@ -163,6 +163,10 @@ pub enum LaunchGuardError {
     #[error("deployment intent unavailable: {0}")]
     DeploymentIntentUnavailable(String),
 
+    /// Policy refuses publication and no override applies.
+    #[error("publication refused: {0}")]
+    PublicationRefused(String),
+
     /// A generated deployment artifact failed local validation.
     #[error("invalid generated artifact {path}: {message}")]
     GeneratedArtifact {

crates/launchguard-core/src/lib.rs

@@ -13,6 +13,7 @@ mod model;
 mod plan;
 mod provider;
 mod provision;
+mod publication;
 mod readiness;
 mod scanner;
 
@@ -54,6 +55,10 @@ pub use provision::{
     OSV_SCANNER_VERSION, PROVISIONED_TOOL_SCHEMA_JSON, PROVISIONED_TOOL_SCHEMA_VERSION,
     ProvisionedTool, Provisioner, TRIVY_VERSION,
 };
+pub use publication::{
+    GateLevel, GateReason, PUBLICATION_DECISION_SCHEMA_JSON, PUBLICATION_DECISION_SCHEMA_VERSION,
+    PreviewOutcome, PublicationDecision, PublicationGate,
+};
 pub use readiness::{
     DimensionScore, READINESS_POLICY_VERSION, READINESS_SCHEMA_JSON, READINESS_SCHEMA_VERSION,
     ReadinessAssessment, ReadinessCheck, ReadinessDimension, ReadinessEngine, ReadinessScores,