sec(door): closed by default, governor fails closed; self-authoring off by default

Three fail-open paths on the §15 door: no env at all meant allow-all; a
governor that could not be reached approved with a WARNING; and a reply
that never said DENY — empty, truncated, a refusal — approved, because the
rule was !contains("DENY"). On the two days the judge plan emptied every
outbound action was approved by nobody.

Now: governor_allows() needs an explicit ALLOW and no DENY; both judge()
implementations return false when unreachable; with no governor the door
opens only on CLAWMATES_DOOR_POLICY=allow. Open Agent Passport (arXiv
2603.20953): 74.6% social-engineering success under a permissive policy,
0 of 879 under a restrictive one. Local override gains the governor prod
already runs.

skill_self_authoring: default flipped to OFF. No agent-authored skill has
ever been delivered to a mission or scored; prod held zero proposals.
Enable with CLAWMATES_SKILL_SELF_AUTHORING=1 once promoted skills go
through the files arm and get a Skill-Use score.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz

crates/cm-runtime/src/lib.rs

@@ -14,7 +14,8 @@ mod tools;
 pub use events::{RunEventBody, RunEventEnvelope};
 pub use outbox::{drain_once, spawn_drainer, EmailSender, LettreSender, SmtpConfig};
 pub use runtime::{
-    judge_model, ProviderRegistry, Runtime, RuntimeConfig, RuntimeError, StartedRun,
+    governor_allows, judge_model, ProviderRegistry, Runtime, RuntimeConfig, RuntimeError,
+    StartedRun,
 };
 pub use sandboxes::{NodeDriverProvider, SandboxManager};
 pub use terminals::{DriveConfig, TerminalManager};