Verdict surface — full gate-decision matrix coverage
The engine-agnostic verdict assembly (scan.rs::Policy::assemble) folds vuln + license + provenance into a Decision (Pass / Warn / Block) and emits a modgunn/verdict-assembly · policy_decision functional-status marker so nornir test SEES the policy evaluation itself (RED ⟺ Block, GREEN otherwise).
The gap this closed
tests/testmatrix_wiring.rs drove that surface for only two of the three gate outcomes — a clean Pass (GREEN) and a High-vuln Block (RED) — asserting exactly 2 assembly rows. The Warn branch (a Medium/Low advisory → not blocked, but not clean either) was never driven onto the matrix, so the field could not distinguish "warned" from "passed" via the test-matrix.
The fix (in code, AI-free at runtime)
Added a Severity::Low advisory (CVE-2099-LOWSEV / leftpad@1.0.0) to the wiring scanner and drove a third scan → Decision::Warn. The single-drain assertion now expects 3 scan_verdict and 3 verdict-assembly rows and asserts the Warn row is GREEN and names the Warn decision in its detail. All three gate outcomes — Pass · Warn · Block — are now matrix-visible.
Reuses edda nornir-testmatrix (drain_functional_rows), no hand-rolled harness. cargo test --features testmatrix --test testmatrix_wiring → green.
