Implement policy decision normalizer and explanation-code registry

[mdheller]

Goal

Implement the SourceOS policy decision model so expected control behavior does not appear as false operator error noise.

Scope

• Add policy decision event contract.
• Add semantic outcome mapping.
• Add explanation-code registry.
• Add default expected-denial rules.
• Cover file, IPC, network, identity, and sync operation classes.

Required explanation codes

• POLICY_EXPECTED_METADATA_BOUNDARY
• POLICY_EXPECTED_NETWORK_DISABLED
• POLICY_UNEXPECTED_FILE_READ
• POLICY_ATTACK_LIKE_PRIVILEGE_BOUNDARY_PROBE
• POLICY_DEGRADED_TRUST_LOCAL_ONLY

Acceptance criteria

• Expected sandbox denies render as notice + blocked_expected.
• Unexpected denials render as warning unless attack-like.
• Policy result and semantic outcome are both preserved.
• Narrative output explains why a block happened.

[mdheller]

Closed: policy decision normalizer and explanation-code registry shipped via PRs #31/#32/#47 (policy-boundary hardening). Expected denials now render with semantic outcome codes (POLICY_EXPECTED_, POLICY_UNEXPECTED_, etc.) and narrative output.