/runs/$runId now reads without a session: public view renders verdict,
per-rule steps, evidence and ai-review findings — never the raw trace or
the workflow snapshot — with a powered-by-tripwire footer and no dashboard
chrome. private/unknown repos fail closed to nothing without a session;
the worker's lazy repo upsert defaults private for the same reason.
mutating + list server functions gain a 401 requireSession gate; decidedBy
comes from the session. run:deny-floor and run:degradation render
distinctly on the run page; /moderation pills run:degraded items.
tests: pure access-policy + trace-strip units, 401 gate units, and a
real-postgres loadRunView integration suite.
