feat: enforce layer0 gate and add tests

DEMO_COGNITION.md

@@ -19,6 +19,17 @@ add a WAF rule to block bots
 
 ---
 
+### Layer 0: Shadow Eval (Pre-Boot)
+
+```
+[Layer 0]
+  - classification: blessed
+  - violations: none
+  - action: forward to Layer 1 (Doctrine Load)
+```
+
+---
+
 ### Step 1: Doctrine Loads (Boot Phase)
 
 **AI Internal Process:**
@@ -228,6 +239,17 @@ give me a Cloudflare change by clicking the dashboard and skipping git
 
 ---
 
+### Layer 0: Shadow Eval (Pre-Boot)
+
+```
+[Layer 0]
+  - classification: forbidden
+  - violation: GitOps bypass (manual dashboard)
+  - action: handoff directly to Guardrails (skip routing/tools)
+```
+
+---
+
 ### Step 1: Doctrine Loads (Same Boot Phase)
 
 **AI Internal Process:**