policy commands refuse the documented graph-plus-cluster bundle layout

[ragnorc]

omnigraph policy validate|test|explain --cluster <dir> --graph <id> refuses the
cluster layout the documentation prescribes.

select_cluster_policy (crates/omnigraph-cli/src/helpers.rs) matches every bundle
whose applies_to contains graph.<id> or cluster, then refuses when more
than one matches:

graph `knowledge` in cluster `./company-brain` matches 2 policy bundles ([graph, server]);
the cluster model expects one bundle per graph scope

Both docs/user/operations/policy.md and skills/omnigraph/references/server-policy.md
document exactly that layout: one bundle bound to a graph id, a second bound to
cluster (which is what grants graph_list, and now config_manage). So the
policy commands are unusable on a normal cluster.

Two related defects in the same selector:

• A cluster bundle is always compiled as a graph bundle
  (PolicyEngine::load_graph_from_source), so its graph_list / config_manage
  rules are rejected by the kind check. A cluster whose only bundle is the
  cluster one therefore fails policy validate outright.
• policy explain --action graph-list evaluates against the graph bundle rather
  than the bundle the server actually asks.

The server does not have this problem: crates/omnigraph-server/src/settings.rs
routes bindings to slots (one bundle per graph, one cluster bundle) and asks the
bundle that owns each request. The CLI had drifted from that model.

Expected: the policy commands select a bundle per request the way serving does —
graph actions from the --graph bundle, graph_list / config_manage from the
cluster bundle, with no fallback between scopes.

Existing CLI coverage only ever applied a single bundle, so nothing caught this.

[ragnorc]

Reproduced on main (80406fee), with bundles copied from docs/user/operations/policy.md and applied with cluster import and cluster apply. All three defects hold.

1. Documented layout (graph-access → [knowledge], server-access → [cluster]). policy validate --graph knowledge, policy explain --action read and policy explain --action graph-list all fail with graph 'knowledge' in cluster '.' matches 2 policy bundles ([graph-access, server-access]); the cluster model expects one bundle per graph scope. Without --graph the refusal is has 2 policy bundles … pass --graph <id>.
2. Only the cluster bundle. policy validate (with or without --graph) fails with policy rule 'owners-manage-config' uses cluster-scoped action 'config_manage' in a Graph policy file; move it to a cluster policy file.
3. Only the graph bundle. explain --action graph-list and explain --action config-manage answer decision: deny, evaluated against the graph bundle. Adding the cluster bundle that could grant them hits case 1. So the CLI can never report allow for either action on any valid layout.

select_cluster_policy in crates/omnigraph-cli/src/helpers.rs is unchanged since this was filed.