pub fn decide(args: &[String]) -> (i32, String)
Core decision logic. Returns (exit_code, json_output). Exit 0 always for allow/block; non-zero only for internal/CLI errors.