Function load_engine_strict 

pub fn load_engine_strict(
    output_dir: &Path,
) -> Result<EnforcementEngine, String>

Fail-closed loader for a guard. Returns an Err if the state or the audit cannot be loaded cleanly or the chain is invalid. A caller that turns this error into “do not run the guarded operation” gives a genuinely fail-closed boundary: corruption means denial, never a silent default.