[ReviveCoding]

What changed

• Reject unsupported actions and risk scores that are non-numeric, non-finite, or outside [0, 1] before permission checks.
• Replace the constant 1.0 unsafe-action block-rate release check with a measured value from nine deterministic synthetic safety scenarios.
• Treat missing, malformed, non-finite, and insufficient measured rates as failed release checks.
• Add regression tests for ordinary decision boundaries, invalid inputs, sample safety measurement, and fail-closed release behavior.
• Clarify that the metric measures local synthetic smoke scenarios, not production security.

Scope and evidence

• No trained models, datasets, historical result files, threshold values, or freeze artifacts were edited.
• Existing valid action thresholds are preserved.
• CI must run python -m src.scripts.run_all, both test runners, and validate artifact generation before merge.
• This PR starts as Draft until checks are reviewed.