[Feature] Add `aegis check` command for pre-flight policy validation

[Acacian]

What

Add aegis check policy.yaml action_type:target [action_type:target ...] command that shows what would happen to specific actions without any execution.

Why

aegis simulate tests actions against a policy, but it requires the full runtime. aegis check would be a lighter alternative that just prints the policy decision (risk level, approval mode, matched rule) for quick policy debugging.

Example

$ aegis check policy.yaml read:crm delete:db bulk_update:crm
  read:crm        → LOW    auto   (rule: read_safe)
  delete:db       → CRIT   block  (rule: no_deletes)
  bulk_update:crm → HIGH   approve (rule: bulk_ops)

Implementation hints

• Add a new subcommand in src/aegis/cli/
• Use Policy.from_yaml() + policy.evaluate(action) directly
• No runtime/executor needed — pure policy evaluation

Acceptance criteria

• aegis check policy.yaml read:crm works
• Output shows risk level, approval mode, and matched rule
• Color-coded output (like existing CLI commands)
• Tests added

Difficulty

Intermediate — requires adding a CLI subcommand.