Closed by default

A build with no scan result does not coast through. Missing evidence is a block, not a pass. Key points:

• The safe default is to deny when evidence is absent, so a skipped or unconfigured scan cannot quietly become a green light.
• "Closed by default" is the property that makes the gate trustworthy: silence is treated as failure, not success.