docs(cli): align access and scope guidance with current model

[KenTaniguchi-R]

Correct stale user-facing and maintainer-facing references to the removed clearance/sensitivity and managed-policy models. Update the CLI policy report/help, package README, Mintlify guidance, and generated references; add focused regression coverage.

[KenTaniguchi-R]

Implemented in 95ceefb (). Corrected policy output/help and generated reference, removed retired managed-policy guidance, aligned setup/scope/security documentation, and added regression coverage. agentcall local CI fix/scope-access-docs mode=fast

── verify — lint, build, docs, typecheck, test, bundle
✓ pnpm lint
✓ pnpm -r build
✓ pnpm docs:check
✓ pnpm -r typecheck
✓ pnpm -r test
✓ wrangler bundles both relay configurations

── invariants — comparing 520a26f...HEAD
✓ third-party actions are immutable
✓ no frame shapes declared outside packages/shared
✓ stored cards parse only through the guarded boundary
✓ relay authentication uses the shared middleware seam
✓ hosted relay host is declared once and matches the wrangler route
✓ historical docs not revised
✓ D1 migration history is append-only
✓ no markdown task board reintroduced
✗ an existing test file lost more lines than it gained on a branch that also changed src/
packages/cli/test/policy-report.test.ts (+11/-14)
If this is a deliberate simplification and not a weakened check, confirm it by eye --
this heuristic cannot tell the difference. Push with --no-verify once you have.
✓ local gate mirrors the verify job in ci.yml

FAILED — see above. Nothing was pushed.
Full logs: /var/folders/89/0_nc_d0j2k7byqmszylpffrh0000gn/T//agentcall-ci.un0nNH
[ELIFECYCLE] Command failed with exit code 1. passes.

[KenTaniguchi-R]

Correction to the previous automated note: completed in commit d0c2af3. The full pnpm verify gate passes, including invariants. The earlier failure was from an unstaged regression test and is resolved in the amended commit.