Create a unified containment policy module

[justsml]

This was generated by AI during triage.

Goal

Create one deep Containment Policy module that owns the immutable per-run authorization and isolation contract.

Scope

• Bind approved target IDs, resolved/pinned destinations and ports, DNS policy, filesystem mounts, capabilities, resource limits, isolation mode, expiry, and approval intent to a run.
• Generate both runtime configuration and the deterministic evaluation contract from that record.
• Persist an auditable policy snapshot and link it to tool runs and generated Artifacts.
• Migrate callers from duplicated policy checks without weakening existing durable approvals.

Acceptance criteria

• Runtime and eval contracts derive from the same normalized policy record.
• Policy mismatches fail closed and are visible in forensic diagnostics.
• Focused tests cover normalization, expiry, scope mismatch, and audit persistence.

Non-goals

Do not make the LLM judge authoritative for containment violations.