- Change post-session gate from only blocking REVISE to requiring explicit APPROVE verdict
- Block tasks from reaching executor when review_spec was never called (null verdict)
- Block tasks on RETHINK, UNAVAILABLE, and reviewer-error paths
- Add tests for all non-APPROVE verdict paths: null, RETHINK, UNAVAILABLE, reviewer throw
- Update existing tests to invoke review_spec with APPROVE so they pass the stricter gate