Function evaluate_release_gate 

pub fn evaluate_release_gate(result: &GenerationResult) -> ReleaseGateResult

Aggregates a GenerationResult into the CRIT/HIGH findings and required actions that actually block release — deterministic, built from result.unresolved/result.findings only, never a second source of truth. required_actions is deduplicated by exact string match (sufficient for now — multiple unresolved fields commonly share the same recommended action, e.g. two properties both needing “a human must first determine whether this property applies”).