pub fn gate(m: &Macro, trust: Trust) -> Result<Vec<String>>
Checks every enabled step against the policy: denied commands and undeclared file access are errors; otherwise returns what the person must approve (empty when nothing).