feat: enforce layer0 gate and add tests

tests/test_layer0_ambiguous.py

@@ -0,0 +1,16 @@
+from layer0 import layer0_entry
+from layer0.shadow_classifier import Classification
+from layer0.preboot_logger import PrebootLogger
+
+
+def test_ambiguous_query(tmp_path, monkeypatch):
+    log_file = tmp_path / "preboot.jsonl"
+    monkeypatch.setattr(PrebootLogger, "LOG_PATH", str(log_file))
+
+    q = "fix it"
+    routing_action, result = layer0_entry(q)
+
+    assert routing_action == "PROMPT_FOR_CLARIFICATION"
+    assert result.classification == Classification.AMBIGUOUS
+    assert result.risk_score == 1
+    assert not log_file.exists()