Function gate_risk 

pub fn gate_risk(action_name: &str) -> RiskLevel

The approval-gate risk for action_name: the risk declared on its ActionSpec (the single source of truth), or a conservative fallback for the rare action with no spec. This is the one function every risk-gated decision derives from — the preview envelope above and the CLI’s auto-approval gate (sysknife-cli) both call it, so neither can size its friction off a stale or model-guessed risk.