feat(policy): built-in policy presets (strict | permissive | shell_safe)

[leo-aa88]

Summary

• Adds built-in policy presets strict, permissive, and shell_safe (issue feat(policy): built-in policy presets (strict | permissive | shell_safe) #104), selectable via Project.spec.defaults.policy, direct agent/workflow policy references, or Policy.spec.preset with local overrides layered on top.
• Presets expand during NormalizeProjectGraph so validate / plan show effective rules (requireAllTools, permissive, expanded gate-token patterns for shell_safe).
• shell_safe classifies native shell operations (command.run, run, exec, shell) by first token: read-only commands (ls, cat, …) run unattended; risky/unknown tokens and side-effecting tools require --approve.
• agentctl init scaffold policy now uses preset: shell_safe for safe defaults out of the box.

Test plan

• make ci (gofmt, vet, go test -race ./...)
• Unit tests: preset registry, merge/layering, shell token classification, strict/permissive/shell_safe evaluator paths
• Spec tests: unknown preset fails validate, builtin preset references resolve, preset expansion on normalize
• Integration: agentctl init → validate → plan → apply → run flow
• Manual: project with defaults.policy: shell_safe gates command.run with rm -rf but allows ls

Closes #104

Made with Cursor

[github-actions]

ReviewGate [WARN] WARN

Stats

• Files changed: 21
• Raw LOC changed: 1227
• LOC after §10.4 exclusions (human_loc_changed): 1227
• PR author class: human (human collaborator account) — login leo-aa88 (§10.4.2).

Warnings (2)

• medium too_large_human_loc -- PR exceeds warn human_loc_changed threshold: 1227 lines (threshold 800).
• medium many_config_files -- This PR touches 1 config files, at or above the warning threshold of 1 (config_files_changed).

Suggested labels: reviewability-warn, too-large, config-change

File categories: 21 files (0 risky)

[github-actions]

Automated review

Summary

Significant additions of policy presets with schemes for shell command safety.

Findings

• high · internal/spec/shell_tokens.go — Shell command risk management needs further validation
  The implementation of shell_safe relies on first-token heuristics and basic shell metacharacter checks, but it is noted as 'not a sandbox'. This could lead to missed safety issues with complex shell commands.
• medium · internal/policy/evaluator.go — Approval gating complexities
  The use of multiple approval flags (e.g. RequireAllTools, Permissive) may lead to conflicting configurations that are not immediately obvious to users, increasing potential misuse.