RO-CLOSE-01

Unmasked close-gate discipline. Any slice that changes canonical bytes, encoded forms, decoder inputs, or golden fixtures MUST run an UNMASKED full close gate (cargo test --workspace) and use cargo's REAL exit status / result line as the sole pass/fail authority for cluster closure. Piped output (| tail, | grep) may be used for display only, NEVER as the pass/fail authority — a pipeline's exit code is the last stage's, not cargo's. Before closure, ALL consumers of the changed canonical output (every golden fixture, decoder, re-encode, and byte-identity test, across all crates — not just the edited crate) MUST be grepped/audited. A cluster is not closed until the unmasked close gate exits successfully.