feat(m7.4): TypeScript safety — policy, approval, audit, RLS

[shamspias]

Makes run() write safely: every write travels policy → approval → audit → execution, mirroring the Python and Go packages.

• policy.ts: DefaultPolicy implements the autonomy ladder (read_only → draft_writes → approved_writes → trusted, §2.10). Reads run freely; a plain write is denied/denied/approval-required/auto-allowed by level; a destructive or confirm-marked write is NEVER auto-executed even when trusted; a batch takes the most restrictive decision. Constraints are enforced here, never sent to the model.
• approval.ts: ApprovalHandler/ApprovalFn, a fail-closed denyAll default (no approval, no write), TerminalApprovalHandler ([y]/[n]/[s]how over injectable streams; denies on EOF and an exhausted re-prompt bound), previewApproval, and bulkCount for the >1-row confirm.
• audit.ts: AuditRecord/AuditSink/MemoryAuditSink, recursive PII redaction (redactArguments — sensitive keys masked in nested objects/arrays, original never mutated), and no-audit-no-action: a write that can't be recorded does not run.
• rls.ts: a scope-annotated capability refuses to run without a principal (fail closed, §2.8); the principal comes only from the run Context (§2.7).
• loop.ts: the policy → gate → audit → execute chain with Go-parity outcomes (completed/executed/refused/not_executed/stopped) and reason codes; ask() still structurally refuses writes and now audits the refusal.
• Agent config gains autonomy/approve/audit/confirmBulk/policy and exposes a readable agent.audit sink.

Reviewed by an adversarial security-review workflow (6 lenses × verify): no §2 violations, and two defense-in-depth/parity hardenings applied — the registry now guards RLS scope at the chokepoint (matching Go's registry.Call), and arg validation uses own-property checks so prototype-named keys (toString/proto/ constructor) can't slip past the schema (§2.6).

Verified: make js-check green — format, typecheck, 89 tests.