pub fn default_mode(tier: RiskTier) -> HitlMode
Default gate mode for a tier. Read runs unattended; everything mutating asks. A channel policy floor (future) may tighten Ask→Deny but never loosen.