Protocol risk gate. Returns `doctrine_action` (BLOCK | ALLOW | ESCALATE), `risk_level`, `risk_score`, and per-domain `risk_domains`. If doctrine_action === BLOCK, halt the action and return `reason_codes` and `recommended_next` to the user. Recheck after `valid_until`. Call this when continuity-mode returns mode !== NORMAL or recommended_posture is require_review or pause.