Add policy-gated action administration

[mzored]

Summary

• Adds persisted run-origin handling and a private control boundary for policy administration.
• Adds a local Policy Gate with receipt checks, bounded action preparation and confirmation, dynamic action schemas, and journal-backed recovery.
• Keeps integrations disabled by default and uses mocked executors only.
• Adds revocation and erasure handling that blocks in-flight work and removes staged action payloads.

Verification

• poetry run pytest -q (728 passed)
• Focused Unit 3, controller, and Gate tests (95 passed)
• Black, isort, flake8, poetry check, and scoped strict mypy passed
• Independent review found no blocking issue in the final repair diff