Hold before unsafe release.

Run structural holds, attribution checks, risk classification, and local review decisions. Missing evidence should hold export rather than imply approval.

Static route shell - review required before release