docs(policy): add verdict-disposal classifier and explicit tier escalation

[LeXwDeX]

Closes #296

Summary

The Verdict Disposal Contract listed four disposal options for a non-ACCEPT checkpoint verdict but gave no rule for choosing among them — so parents either stopped at summarizing (the failure the contract forbids) or reached for a replacement workflow when a bounded in-graph wave was right. Separately, lite→full escalation existed only as a hint.

Change (guide text only, no runtime code)

• orchestration-policy.md: findings classification table inserted into the Verdict Disposal Contract — bounded → same-graph extend; boundary-revealing → escalated full-shaped lanes; misclassified situation → the single legitimate route switch (new workflow); foggy → reasoned stop or user escalation. Adds: route reselection is never the default; escalation is additive; the tier discriminator is risk only — role or block count never selects a tier.
• workflow-routing.md: tier escalation promoted from hint to an explicit rule (non-ACCEPT lite gate → dispose under the contract; findings crossing a full criterion MUST append full-shaped assurance lanes in the same workflow).

Verification

• Command-plugin invariant tests updated to pin the new doctrine (classifier presence, risk-only discriminator, full-shaped correction wave) — bun test test/plugin/command.test.ts 21/21, bun typecheck clean from packages/core.

Note

Wording-only; behavior enforcement lives in #300 (REJECT reachability) — this PR documents how to use it.