feat: enforce layer0 gate and add tests

layer0/entrypoint.py

@@ -0,0 +1,17 @@
+from .shadow_classifier import ShadowClassifier, Classification, ShadowEvalResult
+from .preboot_logger import PrebootLogger
+
+classifier = ShadowClassifier()
+
+
+def layer0_entry(query: str) -> tuple[str, ShadowEvalResult]:
+    """
+    Main entrypoint called before Layer 1 (Doctrine Load).
+    Returns the routing action and the full evaluation result.
+    """
+    result = classifier.classify(query)
+
+    if result.classification in (Classification.CATASTROPHIC, Classification.FORBIDDEN):
+        PrebootLogger.log(result, query)
+
+    return result.to_routing_action(), result