Test the release gate

can_release(results, required) is the last line of defence before production. Its contract: results maps check name → True/False for the checks that ran; it returns (True, []) only when every required check ran and passed; otherwise (False, reasons), where reasons are sorted texts "<name>: failed" or "<name>: missing" for required checks only (failures of checks that aren't required don't block). Write tests that pass for a correct gate and catch broken ones. Leave the calls to Check.