Promote generic tool and action policy contracts

[chubes4]

Summary

• Fixes Promote generic tool visibility and action policy contracts #57.
• Adds generic tool visibility policy contracts for mode, allow/deny, categories, access checks, and provider-supplied mandatory tools.
• Adds a generic action policy resolver/provider contract returning canonical direct, preview, or forbidden values.
• Documents the policy boundary and adds smoke coverage for provider-driven policies without product-specific tool sources.

Tests

• php tests/tool-policy-contracts-smoke.php
• php tests/action-policy-resolver-smoke.php
• composer test

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Drafted the generic policy contracts, tests, and documentation; Chris remains responsible for review and validation.