fix: defer policy engine write to disk until flow completes

Previously, pressing Escape on the gateway selection screen during
policy engine creation would skip to the success screen because the
engine was already written to agentcore.json at the name step. Now
the disk write is deferred until the user completes the entire flow,
so Escape correctly navigates back to the previous step without
persisting a half-configured engine.

Constraint: Must not break non-interactive CLI path which still writes immediately via primitive
Rejected: Only change Escape to go back without deferring write | engine would still be persisted on back
Confidence: high
Scope-risk: narrow

Author: jesseturner21

src/cli/tui/screens/policy/AddPolicyFlow.tsx

@@ -126,23 +126,30 @@ export function AddPolicyFlow({ isInteractive = true, onExit, onBack, onDev, onD
     }
   }, []);
 
-  const handleEngineComplete = useCallback(async (config: AddPolicyEngineConfig) => {
-    const result = await policyEnginePrimitive.add({
-      name: config.name,
-    });
+  const commitEngine = useCallback(async (engineName: string, gateways?: string[], mode?: 'LOG_ONLY' | 'ENFORCE') => {
+    const result = await policyEnginePrimitive.add({ name: engineName });
+    if (!result.success) {
+      setFlow({ name: 'error', message: result.error });
+      return;
+    }
+    setEngineNames(prev => [...prev, engineName]);
+    if (gateways && gateways.length > 0 && mode) {
+      await policyEnginePrimitive.attachToGateways(engineName, gateways, mode);
+    }
+    setFlow({ name: 'engine-success', engineName });
+  }, []);
 
-    if (result.success) {
-      setEngineNames(prev => [...prev, config.name]);
+  const handleEngineComplete = useCallback(
+    async (config: AddPolicyEngineConfig) => {
       const unprotected = await policyEnginePrimitive.getUnprotectedGateways();
       if (unprotected.length > 0) {
         setFlow({ name: 'attach-gateways', engineName: config.name, gateways: unprotected });
       } else {
-        setFlow({ name: 'engine-success', engineName: config.name });
+        void commitEngine(config.name);
       }
-    } else {
-      setFlow({ name: 'error', message: result.error });
-    }
-  }, []);
+    },
+    [commitEngine]
+  );
 
   const handlePolicyComplete = useCallback(async (config: AddPolicyConfig) => {
     const result = await policyPrimitive.add({
@@ -238,7 +245,7 @@ export function AddPolicyFlow({ isInteractive = true, onExit, onBack, onDev, onD
         stepIndicator={<StepIndicator steps={engineSteps} currentStep="attach-gateways" labels={ENGINE_STEP_LABELS} />}
         onConfirm={selected => {
           if (selected.length === 0) {
-            setFlow({ name: 'engine-success', engineName: flow.engineName });
+            void commitEngine(flow.engineName);
           } else {
             setFlow({
               name: 'attach-mode',
@@ -248,7 +255,7 @@ export function AddPolicyFlow({ isInteractive = true, onExit, onBack, onDev, onD
             });
           }
         }}
-        onSkip={() => setFlow({ name: 'engine-success', engineName: flow.engineName })}
+        onBack={() => setFlow({ name: 'engine-wizard' })}
       />
     );
   }
@@ -261,15 +268,12 @@ export function AddPolicyFlow({ isInteractive = true, onExit, onBack, onDev, onD
         gatewayCount={flow.selectedGateways.length}
         stepIndicator={<StepIndicator steps={engineSteps} currentStep="attach-mode" labels={ENGINE_STEP_LABELS} />}
         onSelect={mode => {
-          void policyEnginePrimitive
-            .attachToGateways(flow.engineName, flow.selectedGateways, mode)
-            .then(() => setFlow({ name: 'engine-success', engineName: flow.engineName }))
-            .catch(err =>
-              setFlow({
-                name: 'error',
-                message: err instanceof Error ? err.message : 'Failed to attach policy engine',
-              })
-            );
+          void commitEngine(flow.engineName, flow.selectedGateways, mode).catch(err =>
+            setFlow({
+              name: 'error',
+              message: err instanceof Error ? err.message : 'Failed to attach policy engine',
+            })
+          );
         }}
         onBack={() => {
           setFlow({ name: 'attach-gateways', engineName: flow.engineName, gateways: flow.allGateways });
@@ -360,13 +364,13 @@ function AttachGatewaysScreen({
   engineName,
   gateways,
   onConfirm,
-  onSkip,
+  onBack,
   stepIndicator,
 }: {
   engineName: string;
   gateways: string[];
   onConfirm: (selected: string[]) => void;
-  onSkip: () => void;
+  onBack: () => void;
   stepIndicator?: React.ReactNode;
 }) {
   const items: SelectableItem[] = useMemo(() => gateways.map(name => ({ id: name, title: name })), [gateways]);
@@ -375,16 +379,16 @@ function AttachGatewaysScreen({
     items,
     getId: item => item.id,
     onConfirm: ids => onConfirm([...ids]),
-    onExit: onSkip,
+    onExit: onBack,
     isActive: true,
     requireSelection: false,
   });
 
   return (
     <Screen
       title="Attach Policy Engine"
-      onExit={onSkip}
-      helpText="Space toggle · Enter confirm · Esc skip · Ctrl+C quit"
+      onExit={onBack}
+      helpText="Space toggle · Enter confirm · Esc back · Ctrl+C quit"
       headerContent={stepIndicator}
     >
       <Panel>