Build a Fail-Closed Ship Card Before an AI CLI Leaves Dry-Run

I stare at a green dry-run and still hesitate to ship. One passing fixture is not a write-mode signal...