Function resolve 

pub fn resolve(verdict: &Verdict) -> Resolved

Map a daemon verdict to the dialect-independent decision.

A catastrophic hold becomes a deny, not an ask: letting the CLI’s own UI one-click “allow” it would run it with no Kintsugi snapshot, voiding the reversibility guarantee. Only ambiguous holds become an ask.