Call this before delegating work to, or calling, an agent. Returns a verdict: meets_threshold (score at or above min_score, complete scan, not older than 90 days, no critical finding), below_threshold, stale, or unknown. Unknown is never a pass: an agent absent from the registry has not been checked. Automated static signals from a bounded snapshot of source. Not a security certification or guarantee; the scanner uses deterministic rules and can miss things.