[0.5.0][Stretch] RLAC expansion: conversations/agents + group/time predicates

[erichare]

Stretch goal (pull in if the quarter allows).

Goal

Extend RLAC beyond documents.

Scope

• resourceKind discriminator on enforcer/audit → conversations/agents.
• Rich predicates: group hierarchies + time-bounded visibility (the AST already keeps FuncCallNode open).

Key files

runtimes/typescript/src/policy/*, runtimes/typescript/src/routes/api-v1/agents.ts

Depends on: RLAC P1, P2