CI: Auto-generate DETERMINISM_PATHS from det-policy.yaml DET_CRITICAL entries

[flyingrobots]

Context

In PR #283, DETERMINISM_PATHS in det-gates.yml was expanded from 1 crate to all 14 DET_CRITICAL crates. However, this list is hardcoded in the workflow YAML. If a new DET_CRITICAL crate is added to det-policy.yaml, the workflow won't automatically pick it up.

Desired Behavior

Generate the DETERMINISM_PATHS env var dynamically at CI time by reading det-policy.yaml and extracting all crate paths classified as DET_CRITICAL.

Options

1. Script approach: Add a step that reads det-policy.json and outputs paths
2. classify_changes.cjs enhancement: Output DET_CRITICAL paths alongside classification

Acceptance Criteria

• DETERMINISM_PATHS is derived from det-policy.yaml at CI time
• Adding a new DET_CRITICAL crate to policy automatically includes it in static inspection
• No hardcoded crate list in det-gates.yml