refactor: audit batch 3 (I-3 capability verdict, I-4 policy merge)

- I-3: new models.evaluate_capability returning a CapabilityVerdict
  (ok/missing/unknown from check, known/unknown_missing from split,
  status/verb derivations); decide_routing, worker gateway check,
  worker persisted recheck, dry-run tier+gateway checks and server
  shadow endpoint all call it. Blocking rules stay at the call
  sites (gateway has no worker-default fallback, recheck blocks
  only on known, dry-run/shadow never block); all user-visible
  audit details, dry-run notes and shadow notes are byte-identical.
- I-4: new models.merge_policy_documents shared by
  load_routing_policy and dry_run_from_env; the old tiers-update
  block is kept verbatim (it was a no-op after update(): JSON
  tiers replace the whole map, file tiers absent from JSON are
  dropped -- preserved, not fixed, as that would be a behaviour
  change). dropped_tiers/partial_failures remain load-time
  records, not merge products.
- Tests: test_audit_batch3.py, 13 tests (verdict matrix + parity
  with check/split, decide/dry-run wording, merge boundaries +
  300 seeded random pairs + loader/dry-run agreement).
  Full suite: 1694 OK (skipped=11), baseline 1681 + 13, 0 failures.

cloud/routing_dryrun.py

@@ -72,14 +72,16 @@ try:
     from cloud.models import ROUTING_MODES, ROUTING_TIERS
     from cloud.models import parse_routing_policy
     from cloud.models import parse_tier_requires
-    from cloud.models import check_model_capabilities
+    from cloud.models import evaluate_capability
+    from cloud.models import merge_policy_documents
 except ImportError:  # run as a script from the repo root
     sys.path.insert(0, os.path.join(
         os.path.dirname(os.path.abspath(__file__)), ".."))
     from cloud.models import ROUTING_MODES, ROUTING_TIERS
     from cloud.models import parse_routing_policy
     from cloud.models import parse_tier_requires
-    from cloud.models import check_model_capabilities
+    from cloud.models import evaluate_capability
+    from cloud.models import merge_policy_documents
 
 
 def _tier_dropped_reason(raw_entry):
@@ -210,12 +212,11 @@ def dry_run_policy_document(data, env_mode_override=None,
             cap = {"required": None, "missing": [], "unknown": False,
                    "status": "not_applicable"}
         else:
-            cap_ok, cap_missing, cap_unknown = check_model_capabilities(
+            cap_verdict = evaluate_capability(
                 policy.model_capabilities, policy.tiers[tier], requires)
-            cap = {"required": requires, "missing": cap_missing,
-                   "unknown": cap_unknown,
-                   "status": "ok" if cap_ok else (
-                       "unknown" if cap_unknown else "fail")}
+            cap = {"required": requires, "missing": cap_verdict.missing,
+                   "unknown": cap_verdict.unknown,
+                   "status": cap_verdict.status}
         tiers_report[tier] = {
             "model": policy.tiers[tier], "mode": mode,
             "mode_source": mode_source, "status": status,
@@ -268,17 +269,18 @@ def dry_run_policy_document(data, env_mode_override=None,
                      " -- cannot verify it against the capability"
                      " directory" % (tier, sorted(_req)))
         else:
-            _ok, _missing, _unknown = check_model_capabilities(
+            _gw_verdict = evaluate_capability(
                 policy.model_capabilities, gateway_model, _req)
             _gw["tiers"][tier] = {
-                "status": "ok" if _ok else (
-                    "unknown" if _unknown else "fail"),
-                "missing": _missing, "unknown": _unknown,
+                "status": _gw_verdict.status,
+                "missing": _gw_verdict.missing,
+                "unknown": _gw_verdict.unknown,
                 "tier_mode": _tstatus}
             _note = ("tier %r gateway model %r %s capability:"
                      " %s" % (tier, gateway_model,
-                              "cannot verify" if _unknown else "lacks",
-                              ", ".join(_missing)))
+                              "cannot verify"
+                              if _gw_verdict.unknown else "lacks",
+                              ", ".join(_gw_verdict.missing)))
         if _gw["tiers"][tier]["status"] in ("fail", "unknown"):
             if _tstatus == "active":
                 _gw_blocked = True
@@ -326,7 +328,9 @@ def dry_run_policy_document(data, env_mode_override=None,
 
 
 def dry_run_from_env(env=None):
-    """Dry-run from an env mapping, mirroring load_routing_policy.
+    """Dry-run from an env mapping, sharing merge_policy_documents
+    with load_routing_policy (audit batch 3, I-4) — the merge is
+    one function now, not a mirrored copy.
 
     Returns the report dict. File/JSON failures that the loader
     silently ignores are reported as warnings here.
@@ -354,16 +358,7 @@ def dry_run_from_env(env=None):
                 "(%s); the loader would ignore it" % exc)
             override = None
         if isinstance(override, dict):
-            if not isinstance(merged, dict):
-                merged = override
-            else:
-                merged = dict(merged)
-                merged.update(override)
-                if isinstance(merged.get("tiers"), dict) and \
-                        isinstance(override.get("tiers"), dict):
-                    tiers = dict(merged["tiers"])
-                    tiers.update(override["tiers"])
-                    merged["tiers"] = tiers
+            merged = merge_policy_documents(merged, override)
     _gw_model = (env.get("CLOUD_SUB2API_DEFAULT_MODEL") or "").strip()
     report = dry_run_policy_document(
         merged, env_mode_override=env.get("CLOUD_ROUTING_MODE") or None,