feat(policy): return draft chunk ids from policy proposal submit

[zredlined]

Description

Extend the sandbox-origin policy proposal submit response so callers receive the draft chunk IDs that were created or updated. This lets policy.local follow the exact proposal and read rejection guidance.

Context

Parent: #1062
RFC artifact: https://github.com/NVIDIA/OpenShell/blob/feat/agent-driven-policy-management/rfc/0001-agent-driven-policy-management.md

This is part of the locked Agent-Driven Policy Management MVP. GitHub issues are the development source of truth; Linear is only a roadmap pointer.

Today SubmitPolicyAnalysisResponse returns counts and rejection reasons only, while the gateway assigns UUIDs.

Definition of Done

• Proto response includes returned chunk IDs for accepted/upserted proposals.
• Gateway populates IDs for newly created and updated chunks.
• policy.local proposal submit returns those IDs to the agent.
• Existing callers remain source-compatible.
• Tests cover server-assigned IDs and upserted existing chunks.