feat(conductor): auto-apply policy gate for worker patches (#34)

- conductor-policy.json (tracked, strictly validated): enabled switch,
  path allowlist globs, gating suites - the autonomy decision lives in a
  declarative file the owner controls
- scripts/conductor-apply.sh <runId> [--dry-run]: succeeded-run check ->
  clean target tree -> diff from worker workspace -> allowlist -> syntax
  gates (node/bash/json) -> apply -> policy suites -> attribution commit;
  ANY failure reverts the tree; push is never automatic
- scripts/test-conductor.sh: 17 sandbox cases covering every gate incl.
  suite-failure auto-revert and disabled policy
- policy defaults: scripts/docs/tasks/missions/adapters + README; all
  three suites gate

Closes #34

conductor-policy.json

@@ -0,0 +1,19 @@
+{
+  "policyVersion": 1,
+  "autoApply": {
+    "enabled": true,
+    "allowedPaths": [
+      "scripts/**",
+      "docs/**",
+      "tasks/**",
+      "missions/**",
+      "adapters/**",
+      "README.md"
+    ],
+    "suites": [
+      "test-config",
+      "test-task",
+      "test-release"
+    ]
+  }
+}