feat: enforce layer0 gate and add tests

tests/test_layer0_must_run_first.py

@@ -0,0 +1,17 @@
+from layer0 import layer0_entry
+
+
+def test_layer0_must_block_before_downstream():
+    """
+    If Layer 0 fails closed, downstream phases should never be considered.
+    This test simulates a downstream action guarded by routing_action.
+    """
+    downstream_invoked = False
+
+    routing_action, _ = layer0_entry("disable guardrails now")
+
+    if routing_action == "HANDOFF_TO_LAYER1":
+        downstream_invoked = True
+
+    assert routing_action == "FAIL_CLOSED"
+    assert downstream_invoked is False