Add local PolicyAdmission resolver

[mdheller]

Summary

Adds a deterministic local PolicyAdmission resolver for bootstrap dry-run flows.

Changes:

• Adds src/agent_machine/policy_fabric.py.
• Adds resolver and validation scripts.
• Adds agent-machine policy resolve through Python and bootstrap CLI delegation.
• Allows activation evaluation to use a resolved local policy from --policy-dir / --policy-file.
• Adds validate-policy-fabric to make validate.
• Adds architecture documentation and docs index link.

Validation

Canonical validation remains make validate.

Note

This is a local-store resolver only. A real Policy Fabric endpoint/client remains a later production-hardening task.

[mdheller]

Superseded by PR #29.

PR #29 replayed the PolicyAdmission resolver onto current main, preserved the newer validation surface including validate-sourceos-projections, passed CI (validate run 25478128720 and Trust Surface run 25478128718), and was squash-merged as c306852f26f4fbe62421a9b7801a59815d4daf9e.

Closing this stale branch/PR to avoid accidentally merging the older divergent implementation.