Add repo-scoped agentlock policy

[knhn1004]

Summary

• add safe repo-local .agentlock.yaml discovery and additive policy overlay by cwd
• add agentlock rules install --repo for writing registry gates into repo policy files
• expose rule source metadata in policy view/dashboard and document per-repo trust model

Validation

• CodeRabbit review --agent -t uncommitted: 0 issues after fixes
• go test focused policy/API coverage for gate checks, policy view, and Codex pre-tool-use paths
• bun test ./tests/rules.test.ts
• bun run typecheck (cli)
• bun run typecheck (dashboard-ui)
• bun run build (dashboard-ui)
• git diff --check