release: policy source-of-truth wire-up + cache invalidation webhook

[Shaivpidadi]

Summary

• New DashboardPolicy SQLAlchemy model — read-only mirror of dashboard's Policy table over shared Postgres
• New app/policy_source.py — TTL-cached per-org policy fetcher (60s default) with HMAC-gated invalidation
• evaluate_with_payload_policy now resolves the active policy via org_id when no payload policy is provided; YAML fallback preserved
• New /api/v1/internal/policy/invalidate endpoint — HMAC-signed, dashboard fires on every Policy CRUD write
• 15 unit tests for policy_source (cache hit/miss/TTL/priority/invalidate) + 5 endpoint tests for HMAC enforcement
• Reframed README hero — "the enforcement engine" positioning

Architectural decision

Documented in ADR-005 (meta-repo knowledge/ADR/005-policy-source-of-truth.md): precheck reads directly from dashboard's Postgres Policy table rather than embedding policy in requests or polling HTTP. Justified by: shared DB always present, lowest latency, write-through invalidation closes the staleness window to <500ms in practice.

Test plan

• pytest tests/test_policy_source.py tests/test_policy_invalidate_endpoint.py tests/test_policy_engine.py — 41 tests pass
• End-to-end via meta-repo scripts/sandbox-e2e-test.py — policy.distinct-decisions, policy.cache-invalidation, consistency.policy-mutation (30 prechecks during 3 policy flips), security.forged-hmac, security.missing-hmac all green