Draft: Demonstrate a blocked policy change for assisted repair

This is an intentionally failing, unmerged demonstration candidate for TrustBridge. It removes security_scan from the candidate release policy while keeping the CI job and all enforcement code intact. The policy_review job must fail with MANDATORY_CHECK_MISSING and retain a minimal proposed repair artifact.

Prepared by Codex through the GitLab API. This is real GitLab CI evidence; it is not evidence of a native Duo session or a human checkpoint. Do not merge this branch in its current state.

Next: run the registered TrustBridge assisted flow, inspect the actual proposal, record a real human decision, and verify the resulting policy-only repair against the independent controller. No merge or deployment is authorized by a green application pipeline.