Add local PolicyAdmission resolver v3

[mdheller]

Summary

Adds a clean, current-main local PolicyAdmission resolver for bootstrap dry-run flows.

Changes:

• Adds src/agent_machine/policy_fabric.py.
• Adds scripts/resolve-policy-admission.py.
• Adds scripts/validate-policy-fabric.py.
• Adds agent-machine policy resolve through Python and bootstrap CLI delegation.
• Allows activation evaluation to use a resolved local policy from --policy-dir / --policy-file.
• Adds validate-policy-fabric to make validate, while preserving validate-sourceos-projections from current main.
• Updates package validation to import agent_machine.policy_fabric.
• Adds docs/architecture/policy-admission-resolution.md.
• Links PolicyAdmission resolution from docs/index.md.

Validation

Canonical validation remains:

make validate

Supersedes

This supersedes stale PR #22, which was based on an older main branch.

Production note

This is a deterministic local-store resolver only. A real Policy Fabric endpoint/client remains a later production-hardening task.