Classify defects by both code trigger and operational activation

A defect's presence in source does not establish operational impact. For each finding, record the code predicate, environment and configuration gate, required data shape, and whether the affected workflow is currently reachable. Assign severity from the combined activation state, and distinguish runtime impact from release-process blockers. Recheck all gates from authoritative sources; a dormant path can still block artifact publication without affecting current requests.