feat: policy composition — is_stricter_than + tenant inheritance

[jpleva91]

Context

Harvested from Microsoft AGT. Child policies should never loosen parent constraints. Essential for multi-tenant governance.

Proposal

• Add is_stricter_than(parent Policy) bool method to policy engine
• Support policy inheritance: base → tenant → project → session
• Validate at load time that child policies only tighten, never loosen

Harvest source

Microsoft AGT trust_policy.py — is_stricter_than() pattern

[jpleva91]

Migrated to chitinhq/chitin#40