M1: Add built-in deterministic policy checks

[dbrosio3]

Summary

• Add opt-in policies config for built-in deterministic checks.
• Implement diff_size and forbidden_paths policies with explicit blocking and warning output.
• Extend changed-file metadata with text line counts and update docs, templates, schema, and tests.

Validation

• pnpm test
• pnpm run build
• pnpm run check:shell
• pnpm run lint:shell
• git diff --check

Closes #7