037-closed-admission-gate

Envelope admission evaluates through action-gate's closed mode, with identical decisions and bytes

Amends 005 for how the envelope's admission::evaluate combines its requirements. It builds one closed action-gate gate per evaluation (action-gate-core 0.3.0, action-gate spec 004), with one required check per requirement registered in today's reason order, and maps every deny back to its RefusalCode. Decisions, refusal codes, their order, the serialized Admission and the policy-eval claim are unchanged, which a differential test against the frozen pre-change evaluator proves. The envelope stays pure and Apache-2.0; the policy digest stays the policy's identity.