feat(policy): intersect delegated scope with local Cedar policy

[imran-siddique]

Wire the Cedar engine so effective permission = verified delegated scope INTERSECT local policy allow. Needs the call-time enforcement point (see runtime issue). Unblocks claim C3. See docs/spec/cedar-policy.md.

[imran-siddique]

Partial: PR #22 landed scope-policy intersection as a decision core against a capability allow set (ca2a_runtime.policy.LocalPolicy), validating claim C3. This issue remains open for binding a full Cedar policy engine as the local policy (the intersection semantics are policy-language-agnostic; the allow-set model stands in today).