Add Policy Fabric admission scaffold

[mdheller]

Summary

Adds a dependency-free Policy Fabric admission scaffold for AgentTerm.

This PR implements the first tested policy-admission boundary for issue #3 without claiming live Policy Fabric service integration yet.

It adds:

• PolicyDecision model.
• PolicyFabricBackend protocol.
• InMemoryPolicyFabricBackend for tests and local development.
• PolicyFabricAdapter with allow/deny/pending/unknown semantics.
• Fail-closed behavior for side-effecting events and sensitive context release.
• Tests for non-sensitive events, missing decisions, allow decisions, deny decisions, pending decisions, explicit policy actions, and sensitive-context flags.

Boundary decisions

• AgentTerm remains the operator surface and event log.
• Policy Fabric remains the authority for action admission, denial, obligations, and sensitive context-release posture.
• Missing, pending, or deny decisions fail closed.
• This does not add live network integration yet; it creates the contract and test harness for that next step.

Validation

Expected CI:

ruff check .
pytest

Part of #3.