docs: restructure and polish safety and policy section

[miyoungc]

Reorganize the Safety and Privacy documentation section: remove the redundant security-model page, extract default policy content into its own page, polish the policies page, and add a Sphinx extension that auto-generates policy reference tables from YAML.

Part of #187

Changes

Documentation structure

• Delete security-model.md — content was already covered by safety-and-privacy/index.md; keeping both created redundancy.
• Add default-policies.md — new page documenting the built-in default policy, agent compatibility table (Claude Code / OpenCode / Codex), and what the default policy allows.
• Add reference/default-policy.md — new reference page that uses the policy-table directive to render the full default policy from YAML.
• Update toctree in index.md to replace security-model with default-policies.

Sphinx extension (docs/_ext/policy_table.py)

• Custom directive (policy-table) that reads the sandbox policy YAML (dev-sandbox-policy.yaml) and auto-generates:
  • A Filesystem, Landlock, and Process summary table.
  • One subsection per network_policies block with endpoint tables (host, port, TLS, access/rules) and allowed binary lists.
• Human-readable titles and descriptions for each known policy block (e.g., "Anthropic API and Telemetry", "Git Clone and Fetch", "Python Package Installation").
• Registers the YAML as a Sphinx dependency so tables rebuild when the policy file changes.
• Update docs/conf.py — register the _ext directory on sys.path and add policy_table to extensions.

Content polish (policies.md)

• Move "Default Policy" section (agent compatibility table and related guidance) to the new default-policies.md page.
• Rename "How do I edit it" → Hot-Reload Policy Updates.
• Rename "If something is blocked" → Debug Denied Requests.
• Tighten GitHub repo access example intro.
• Remove bold formatting from numbered workflow steps.
• Update Next Steps links.

Cross-reference fixes (5 files)

• Update all security-model references → index or default-policies across overview.md, run-claude.md, run-opencode.md, providers.md, and index.md.
• Fix duplicate link in run-claude.md where two Next Steps items both pointed to policies.md.

Test plan

• mise run docs:serve builds without warnings or broken references
• All cross-page links in the Safety and Privacy section resolve correctly
• policy-table directive renders tables from the YAML in reference/default-policy.md