fix(vclt-gate): reject on levels[].status=="fail", not never-emitted "admitted"

extract_reasons rejected levels where l["admitted"]==true, but the vcl-ut
gate producer never emits an "admitted" key — it emits per-level status in
{"pass","fail"}. The reject therefore kept every level and mis-listed
passing levels as rejection reasons. Switch to Enum.filter(status=="fail")
so `failed` holds the genuinely-failing levels, and update the test stub to
the real status schema (it had fabricated an "admitted" key, masking the
drift across the cross-repo seam).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

elixir-orchestration/lib/verisim/query/vclt_gate.ex

@@ -155,7 +155,7 @@ defmodule VeriSim.Query.VCLTGate do
       {:ok, %{"levels" => levels}} when is_list(levels) ->
         failed =
           levels
-          |> Enum.reject(fn l -> l["admitted"] == true end)
+          |> Enum.filter(fn l -> l["status"] == "fail" end)
           |> Enum.map(fn l ->
             "#{l["name"]} (L#{l["level"]}): #{l["reason"] || "rejected"}"
           end)

elixir-orchestration/test/verisim/query/vclt_gate_test.exs

@@ -54,7 +54,7 @@ defmodule VeriSim.Query.VCLTGateTest do
 
       File.write!(stub, """
       #!/bin/sh
-      echo '{"certified_level":-1,"levels":[{"level":4,"name":"InjectionProof","admitted":false,"reason":"SQL injection detected"}]}'
+      echo '{"certified_level":-1,"levels":[{"level":4,"name":"InjectionProof","status":"fail","reason":"SQL injection detected"}]}'
       exit 1
       """)