feat: add fail-closed policy enforcement (DSE-716)

[ernestprovo23]

Summary

• add the side-effect-free Policy Decision Point and fail-closed decision model
• add the Policy Enforcement Point with evidence-before-effect ordering
• add signed lease, capability, revocation, handler-identity, and conformance primitives
• sync README, architecture, documentation index, security docs, and project metadata

Verification

• ruff format --check, ruff check ., compileall: pass
• MkDocs strict build: pass
• full tests: 790 passed, 7 skipped; macOS sandbox-isolated process test: 1 passed outside sandbox
• coverage: 85.48% (80% floor)
• gitleaks staged scan: no leaks
• independent security re-audit: SHIP
• five-provider Conclave adversarial review: SHIP, no blocking findings
  • request: 9adee35a28f148d2b49c03b963105100

Scope note

Four non-blocking WARNs concern hardening before future production wiring (marshal-encoded code constants, CPython opcode-range pinning, an explicit sink-before-output assertion, and revocation-generation semantics documentation). They do not block this foundation milestone and are preserved in the SDLC/Linear handoff.

Linear: DSE-716