[Phase 13] Add a safe-default policy evaluator

[cosentinode]

Scope

Add pure effective-policy evaluation for additive protected branches, stable operation families, confirmation escalation, disabled operations, and minimal prompt controls.

Acceptance Criteria

• main/master/develop/release/* remain protected and config can only add patterns.
• Config cannot lower built-in confirmation requirements.
• Disabled operation families cover all internal variants.
• Tests cover wildcard boundaries, malformed patterns, and risk transitions.

Verification

• cargo fmt --all --check
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo test --locked --workspace

Notes

Child of #15; depends on safe TOML configuration.