Add governance policy framework (RFC-MACP-0012)

[ajit-zer07]

Summary

• Governance policy framework (RFC-MACP-0012): Add src/policy/ module with
  policy registry, rule types (per-mode JSON schemas), evaluators, and default
  policy. Policies are resolved at SessionStart via policy_version and
  evaluated at commitment time in all five standard modes (decision, proposal,
  task, handoff, quorum).
• Policy gRPC lifecycle RPCs: Implement RegisterPolicy, UnregisterPolicy,
  GetPolicy, ListPolicies, and WatchPolicies server-streaming endpoints
  on the gRPC service, with PolicyRegistryCapability advertised in Initialize.
• Proto management migration: Remove vendored proto/ directory and buf.yaml/
  buf.lock. Proto definitions are now sourced from the macp-proto crate via
  DEP_MACP_PROTO_PROTO_DIR in build.rs. CI jobs lint-protobuf and
  proto-sync are removed; Makefile targets sync-protos, sync-protos-local,
  and check-protos are removed.
• New error variants: UnknownPolicyVersion, PolicyDenied,
  InvalidPolicyDefinition added to MacpError.
• Commitment authority helper: Extract check_commitment_authority into
  src/mode/util.rs, used by all modes for consistent initiator-only commitment
  checks with policy-driven designated_roles override.
• Session model: Add policy_definition: Option<PolicyDefinition> to Session,
  populated at start and re-resolved during replay.
• Mode-specific policy evaluation: Each mode evaluates its policy rules at
  commitment time (e.g., voting algorithm for decision, quorum thresholds,
  proposal acceptance criteria, task completion requirements, handoff implicit
  accept timeout).

Test plan

• cargo test — unit tests pass, including new policy evaluation tests
  in each mode module and error variant coverage
• cargo clippy / cargo fmt — no warnings or formatting issues
• cargo build — successful build with macp-proto crate dependency
• Conformance JSON fixtures updated for policy_version field changes
• Integration test for policy registry added
  (integration_tests/tests/tier1_protocol/test_policy_registry.rs)
• make test-integration-grpc — Tier 1 gRPC tests pass with new policy RPCs
• Verify Dockerfile builds without vendored proto/ directory