clash policy convert: accept minimal legacy policy.json shapes

[eliothedeman]

Follow-up from #445.

clash policy convert requires the full PolicyManifest JSON shape (default_effect, default_sandbox, sandboxes, tree). Minimal historical manifests like {"default_effect":"deny","rules":[]} fail to parse.

This isn't a regression introduced by #445 — convert already worked this way — but it surfaces awkwardly now that convert is the only way for users with legacy policy.json files to migrate. Users with old, minimal manifests will hit a parse error and have nowhere obvious to turn.

Suggested fix

Make PolicyManifest deserialization lenient about historical shapes:

• Accept rules: as an alias / fallback for tree:
• Default sandboxes: to [] when missing
• Default default_sandbox: to null when missing

OR: add a "best effort" path in handle_convert that accepts a more permissive top-level dict and emits a .star skeleton with a warning about which rules couldn't be carried over.

Acceptance

• A policy.json with only default_effect + rules: round-trips through clash policy convert and produces a usable policy.star
• Test fixture for the minimal-manifest case lives under the convert test suite