pub fn gate_for(cfg: &CliConfig) -> Result<Arc<EffectGate>, String>
Build the CLI gate: allow-all unless a policy is configured.