v0.8.2

The built-in check tool now previews arg_match rules: pass {"tool": "crm__export", "args": {"scope": "all"}} and the dry run reports the decision without fetching. Engine.simulate runs argument checks at each step.

Also adds three protection packs to the reference policy: customer-data (on), pci-dss (off), insider-trading (off).