Evaluate, sign, attest, revoke, and roll back portable policy bundles

Problem/Motivation

An installed module or opaque UI configuration does not prove that a particular governed policy is active. Sentinel needs a portable signed artifact, local verification/evaluation, active-revision attestation, and safe disconnected/recovery behavior.

Proposed resolution

Implement the Drupal enforcement leg of the portable policy lifecycle: validate/simulate, verify a signed immutable bundle, activate and attest its revision, cite it in decisions, and support emergency deny, revocation, and rollback.

Acceptance criteria

• The policy artifact has a versioned portable schema and immutable digest.
• Local verification rejects invalid, revoked, expired, or unauthorized signatures.
• Simulation evaluates a hypothetical action without execution against the candidate policy.
• Activation is atomic and attests the exact active revision.
• Every governed decision cites the active policy digest.
• Upstream allow cannot widen local deny.
• Emergency deny, revocation, rollback, and bounded last-known-good behavior are tested.
• Disconnected operation never mints new authority or grants.
• The contract remains provider-neutral and does not require a second system-of-record adapter.

API changes

Adds versioned policy-bundle, simulation, activation-attestation, revocation, and rollback contracts.