Add local PolicyAdmission resolver

[mdheller]

Summary

Adds a deterministic local PolicyAdmission resolver for bootstrap dry-run flows.

Changes:

• Adds src/agent_machine/policy_fabric.py.
• Adds resolver and validation scripts.
• Adds agent-machine policy resolve through Python and bootstrap CLI delegation.
• Allows activation evaluation to use a resolved local policy from --policy-dir / --policy-file.
• Adds validate-policy-fabric to make validate.
• Adds architecture documentation and docs index link.

Validation

Canonical validation remains make validate.

Note

This is a local-store resolver only. A real Policy Fabric endpoint/client remains a later production-hardening task.