Function cert_override_decision_full 

pub fn cert_override_decision_full(
    store: &TrustStore,
    host: &str,
    session_allow: bool,
    soft_denied: bool,
    chain_verified: Option<bool>,
) -> CertOverrideDecision

Full policy: store + optional session allow-once + optional chain verify result.

session_allow — process-local allow-once for this host.
soft_denied — sticky deny without re-prompt.
chain_verified — Some(true/false) after B path crypto; None if no leaf PEM available.