security: document the fail-open vs fail-closed behavior of every read-only compliance check

[Idaonoli]

Scope

denylist-gate::check's doc comment explicitly calls out its fail-open risk on TTL archival ("check() would return true... a fail-open footgun"). The other contracts' equivalent read paths (is_allowed, is_permitted_jurisdiction, is_frozen) don't have the same explicit fail-open/fail-closed analysis documented.

Acceptance criteria

• Audit is_allowed, is_permitted_jurisdiction, is_frozen, and compliance-aggregator/policy-engine's composed checks for their fail-open/fail-closed behavior under storage archival or misconfiguration, and document each explicitly