refactor: compose maintenance gate policies

[bioinformatist]

Summary

• expose a reusable maintenance policy base and a workstation-only overlay through lib.maintenancePolicy
• make maint-switch and China gate scripts evaluate the target flake's effective policy
• retain a narrow compatibility path for revisions created before the flake policy interface
• compare policy marker lists by semantic set contents in the delta gate

Verification

• env NIXPKGS_ALLOW_UNFREE=1 nix flake check --impure --allow-import-from-derivation
• nix develop -c actionlint .github/workflows/maintenance-gate.yml .github/workflows/maintenance-leaf.yml
• old-main versus new-head China delta gate: no new blocked or direct outputs
• full China gate for homePC, linglong, and ci@headless: passed