Honor judge BLOCK when score is low

[chiruu12]

Summary

• Clamp judge finding scores so declared action drives enforcement: block raises to at least block_threshold, review lands in the review band, allow caps below review_threshold
• Wire ScanPolicy thresholds through InputPipeline → JudgeResult.to_finding
• Document the contract in LIMITS_AND_JUDGE.md

Fixes#86

Test plan

• make check
• make test-cov (sdk; ≥80%)
• Low-score judge action=block → Action.BLOCK via CallableJudge
• High-score judge action=allow stays ALLOW when scanners are clean
• Unit tests for enforced_score / string "block" parsing

[greptile-apps]

Greptile Summary

This PR makes judge actions drive score-based enforcement. The main changes are:

• Added score clamping for judge block, review, and allow results.
• Passed ScanPolicy thresholds into judge finding conversion.
• Added tests for low-score blocks and high-score allows.
• Documented the judge action and score contract.

Confidence Score: 4/5

The judge action path can still return the wrong enforcement result.

• Allow findings can be raised again by the sensitive-context boost.
• Review findings can become redact or block when custom thresholds collapse the review band.
• The changed threshold wiring otherwise matches the intended flow.

sdk/src/unplug/core/judge.py

Important Files Changed

Filename	Overview
sdk/src/unplug/core/judge.py	Adds judge score clamping, but some policy and boost interactions can still override the declared action.
sdk/src/unplug/pipelines/input.py	Passes ScanPolicy thresholds into judge finding conversion.
sdk/tests/integration/test_guard_limits.py	Adds integration coverage for low-score block and high-score allow behavior.
sdk/tests/unit/core/test_judge.py	Adds unit coverage for enforced score behavior and string action parsing.
sdk/docs/LIMITS_AND_JUDGE.md	Documents how judge actions affect score handling.

_{Reviews (1): Last reviewed commit: "Honor judge BLOCK when score is low" | Re-trigger Greptile}

[github-actions]

SDK Coverage •

File	Stmts	Miss	Cover	Missing
src/unplug/core
judge.py	83	4	95%	65, 73–74, 164
src/unplug/pipelines
input.py	88	4	95%	147, 164–166
TOTAL	7248	896	87%

Tests	Skipped	Failures	Errors	Time
1208	25 💤	0 ❌	0 🔥	40.387s ⏱️