New JDK-only `ops-cag` module: the one configuration item engineered to the
ECSS Category B technical bar (SDP §1.1) inside the otherwise Category D
product. It decodes every telecommand, classifies it by content into an
authority tier, and decides forward / reject / hold — fail-closed on
anything it cannot classify, including a gap in its own classification
table. The authorization decision moved out of the gateway, which retains
only the session TC budget.

Fixes the defect ADR-0007 §4 recorded: before M1h the only barrier holding
a state-changing telecommand for human confirmation was the MCP *client's*
permission prompt. A different client, or one set to auto-allow, removed it
silently. The barrier now lives inside the gate, and no MCP tool records
confirmations at all — a client cannot confirm the command it submitted.

ICD Issue 8, confined to §8.4 (three injection outcomes, the confirmation
channel declared unreachable through MCP, the M1f carve-out for undecodable
raw octets withdrawn). No space-link change (§2–§7), no reference vector
touched, no new third-party dependency.

Gate: 160 tests green, pus-core line coverage 97.2 %, TraceabilityCheck
M1h gate 0 findings, SIM-TC-048..052 PASS, SIM-REQ-CAG-001 reviewed-PASS.
Record: docs/test-reports/M1h-report.md

The Category B verification bar (hazard analysis, software FMEA, 100 %
statement+decision coverage, robustness suite) is M1i scope per SCR-011.
Containment limits per ADR-0007 C8 stand as written; independence remains a
recorded deviation with no compliance claim. ADR-0007 is baselined and
immutable from this tag.