fix(policy): Restructure policy evaluation for per-violation callbacks

[anormang1992]

Summary

• PolicyGate.evaluate() now returns list[PolicyViolation] instead of PolicyResult — the gate collects violations, orchestration lives in VRE.check_policy()
• Hard blocks (requires_confirmation=False) are immediate and non-overridable — on_policy is never consulted
• Confirmation-required violations are the only ones routed to on_policy, which now receives list[PolicyViolation] instead of a single message string
• PolicyCallbackResult model for structured callback returns — passed=True means the action passes the policy (no violation), passed=False means it fails (violation fires)
• PENDING enum value removed — PolicyAction is now PASS or BLOCK only
• Claude Code hook combines all confirmation violations into a single bulleted TUI prompt
• Demo ProtectedFileDeletePolicy callback that inspects rm commands for protected files via literal match, glob expansion against the filesystem, and recursive directory inspection
• parse_bash_primitives returns the base command name for unrecognized commands instead of an empty list, giving visibility into why unknown commands are blocked

Test plan

• All 205 existing tests pass
• Ruff lint clean
• New tests for PolicyCallbackResult semantics, mixed violation orchestration, and on_policy passthrough
• Demo tested with protected file deletion scenarios (literal, glob, directory)
• Verify Claude Code hook TUI renders bulleted violations correctly

🤖 Generated with Claude Code