fix(sdk): fail closed on post-hook evaluation errors

[lan17]

Summary

• make unexpected post-hook control evaluation failures fail closed instead of only logging
• route pre/post hook evaluation through a shared helper so the enforcement policy stays consistent
• add a regression test covering post-hook RuntimeError behavior

Testing

• make sdk-typecheck
• make sdk-test

Closes #112

[namrataghadi-galileo]

LEts start with fail-closed. If the response is to have it fail open, we can change it later.