Fix the ship or hold rule before a freeze

It is 5 pm before a launch freeze. An AI agent produced a 400 line change that wires a new feature flag through your auth middleware, and your lead wants it shipped unreviewed. Your team settles calls like this with a written rule, not with the clock.

An assistant wrote freeze_ship_decision(lines_changed, touches_auth, flag_defaults_off, minutes_left, already_reviewed). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• lines_changed: how many lines the change touches.
• touches_auth: true when the change touches authentication code.
• flag_defaults_off: true when the new code sits behind a feature flag that is off by default.
• minutes_left: minutes until the freeze.
• already_reviewed: true when a person has already reviewed the change.
• Return one of "ship_now", "triage_targeted_review", "ship_behind_default_off_flag" and "hold_until_after_freeze".

Rules the tests check:

• A negative lines_changed or minutes_left counts as 0.
• A change is risky when it touches auth, or when it changes more than 100 lines. Either one is enough.
• The triage time is the line count divided by 40, rounded up, and never less than 1 minute.
• Return the first that applies:
  1. "ship_now" when the change is not risky.
  2. "ship_now" when it was already reviewed.
  3. "triage_targeted_review" when the minutes left are at least the triage time.
  4. "ship_behind_default_off_flag" when the flag is off by default.
  5. "hold_until_after_freeze" otherwise.