Enforce trusted-agent policy conditions

[lazyGPT07]

Summary

• keep allow_if_trusted_agent evaluation inside its policy branch
• allow trusted principals as before
• require approval for untrusted or missing principals instead of falling through to the generic low-risk allowance
• add regression coverage for all three principal states

Root cause

The trusted-agent branch returned only for a trusted principal. A principal that did not satisfy the condition continued through generic risk evaluation, where low-risk read actions could be allowed despite the explicit policy.

Validation

• vitest run packages/account-core/src (8 tests passed)
• tsc -p packages/account-core/tsconfig.json --noEmit
• git diff --check

Fixes #71