feat: add deterministic workflow policy guardrails

[HelgeSverre]

Summary

Implements the deterministic guardrail foundation from #50 end to end:

• compile fail-closed model, tool, semantic-subject, input, output, metadata, and completion policies
• compose workflow and step policy layers as an intersection with the strictest denial action
• enforce model and content policy across completion, streaming, batch, pmap, embedding, reranking, cache, and cassette paths
• enforce tool-name and semantic capability rules before direct or agent-loop tool execution
• buffer guarded streams so denied output never reaches callbacks
• return structured policy denials with policy, boundary, subject, rule, reason, action, and source
• journal policy checks, redactions, violations, bypasses, and successful tool-result evidence without recording raw protected values
• require workflow metadata and evidence events before nominal success
• export provider-neutral evidence bundles with JSON, Markdown, and a SHA-256 manifest via sema workflow export
• validate package sema_version_req for registry, git, explicit, locked, add, update, and publish paths before replacing local files
• document the policy language, semantic tool subjects, completion evidence, and package workflow

A companion sema-policies 0.1.0 standard pack has been implemented in the packages workspace with reusable constructors and conservative public-sector-rag / ai-act-docs-lite baselines. It requires Sema >=1.34.0 and has not been published. Registry-side manifest validation is in sema-lisp/pkg#2.

Scope boundary

This PR does not close #50. Deliberately deferred:

• human approval state machines
• sensitivity-aware model rerouting
• domain-specific semantic classifiers and attack packs
• a public policy assertion/test DSL
• browser/WASM workflow enforcement rollout

No source or rule definitions were copied from the commenter-linked HeartFlow repository because it does not provide a license. The generic literal/regex output-rule design is independently implemented.

Semantics

• A present policy section is fail closed.
• Policy lists can only tighten behavior; a step cannot loosen its workflow policy.
• Model :skip applies only during fallback selection; direct calls fail.
• Tool :tool-error applies only inside agent loops; direct invocation fails.
• Hard tool denial preflights a batch and runs no sibling handlers.
• Input guards run before telemetry, cache, cassette, or provider dispatch.
• Output guards run before callbacks, persistence, or response telemetry.
• Workflow permissions and the CLI sandbox remain the outer capability ceiling.

Validation

• cargo clippy --workspace -- -D warnings
• cargo fmt --all -- --check
• focused core/runtime suites: 1,640 passed
• workflow policy suite: 25 passed
• evidence exporter tests: 2 passed
• unified runtime inventory: 937 exact matches
• generated builtin docs: 1,026 entries, coverage passed
• companion package tests: 4 passed; quick-start passed
• git diff --check

Refs #50

[HelgeSverre]

Merged into #143 — single combined PR