What is a reliable gate for env var and dependency contract checks in code review?