Promotion gate: enforce the consumed review verdict before rollout, seal it into evidence

[mdheller]

Problem

Continuum's Rollout stage (LIFECYCLE §4) promotes a proven workload up and out with drain/rollback gates and promotion evidence — but there is no gate that requires an independent review verdict before promotion. The review capability is model-backed and therefore consumed from prophet-platform (per CONTINUUM_SCOPE.md and this repo's CapD links.integration_target), not owned here.

Scope (owned by continuum)

• Declare the review gate in the CapD composes_with (pin-not-vendor).
• Document the promotion gate in LIFECYCLE §4 (Rollout): promotion requires an APPROVE verdict; the sealed verdict is emitted to the per-action evidence bundle (policy evidence_emitting).
• tools/promotion_gate.py: given the reviewer's sealed review receipt (produced by the consumed prophet-platform reviewer), verify its seal, require verdict == APPROVE, write it as a per-action evidence artifact, and exit 0 (promote) / non-zero (block). Fail-closed.

Explicitly NOT in scope (consumed, not reimplemented)

• The review logic / model — owned by prophet-platform (tools/review_gate.py), consumed here.
• Source, workspace binding, runtime release, scale-up — their canonical owners.

Acceptance

• make validate passes; CapD keys intact, no ellipses.
• promotion_gate.py: APPROVE→exit 0 + evidence written; REJECT/NEEDS_HUMAN/tampered-seal→non-zero, no promotion. Tested both ways.
• Known gap (explicit): the live pinned reviewer invocation runs in the rollout pipeline where prophet-platform's reviewer is available; this issue wires the gate + evidence contract, consuming a verdict.