Fail-closed B2A security gate for autonomous agent actions with signed policies and verifiable receipts.
