Agent Gate v0.2.3

v0.2.3 adds zero-config observe-mode onboarding while keeping policy retrieval fail-closed.

Changed:

• First-run installs can use the built-in default policy when the default base-branch agent-gate.yml is confirmed absent.
• Other policy retrieval failures remain fatal, including custom config path misses, permission errors, rate limits, server/API failures, malformed content responses, and invalid YAML/schema.
• Reports record default-policy fallback as configSource: default.
• Markdown reports and job summaries include a human-readable policy source, such as Policy source: built-in default.
• The security model now documents the built-in default policy as trusted input bundled with the pinned Action ref.

Not included:

• npm publishing
• Marketplace settings changes
• repository or workflow settings changes