feat(governor): watch policy directory reloads

[joelteply]

Summary

• add Rust policy_watcher module for deterministic TOML policy directory loading
• expose watch_policy_directory / reload_policy_candidates for LocalSubstrateGovernor hot reload
• fail loud on missing, empty, malformed, and watcher errors; callback records last error instead of replacing valid candidates with bad state

Proof

• cargo test --manifest-path src/workers/continuum-core/Cargo.toml --lib --features metal,accelerate governor::policy_watcher:: -> 8 passed
• cargo test --manifest-path src/workers/continuum-core/Cargo.toml --lib --features metal,accelerate governor:: -> 146 passed
• precommit -> TS passed; targeted Rust clippy at baseline; browser gate skipped because local jtag/core IPC prerequisites were down
• prepush -> TS, ESLint, Rust compile, Rust tests passed; native Docker image step did not run because hook-generated tracked-file churn made the docker script refuse mixed source state before I cleaned the temp worktree