fix(rank): reject an unknown veto verdict instead of shortlisting the job (#640)

* fix(rank): reject an unknown veto verdict instead of shortlisting the job

Step 5's veto is an exact match on "FAIL", so a scoring agent's "Fail" or
any other off-contract location_verdict/language_gate value was stored
as given and a deal-breaker job reached the shortlist. Report it as an
errors row and leave the entry unwritten, as an unknown status already is.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* changelog: place the #640 entry under [Unreleased]

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Mads Lorentzen <madslorentzen_17@hotmail.com>

tests/test_rank_state.py

@@ -859,6 +859,17 @@ class Unreachable(RankStateCase):
         self.assertEqual([r["key"] for r in out["ranked"]], ["b"], "valid results in the same batch still apply")
         self.assertEqual(self.read_state()["a"]["status"], "new")
 
+    def test_an_unknown_gate_verdict_is_an_error_not_a_shortlisted_job(self):
+        scores = {dimension: 90 for dimension in ("technical", "experience", "behavioral", "career")}
+        for field, value in (("location_verdict", "Fail"), ("language_gate", "fail"), ("location_verdict", "REJECT")):
+            with self.subTest(field=field, value=value):
+                self.write_state({"a": entry()})
+                result = {"key": "a", "status": "scored", "scores": scores, field: value}
+                out = self.run_tool("apply", "--results", self.results([result]), expect=1)
+                self.assertEqual(out["ranked"], [], "a deal-breaker spelled differently must not reach the shortlist")
+                self.assertIn(f"unknown {field} {value!r}", out["errors"][0]["error"])
+                self.assertEqual(self.read_state()["a"]["status"], "new", "a rejected result never half-writes an entry")
+
 
 if __name__ == "__main__":
     unittest.main()