[GoDeskio]

Backlog #12.

• src/policy.rs: a policy has all-of attributes, any-of groups, and a not-before/expires window.
• Policies are stored in canonical text inside EGP1 blobs, and the policy hash is folded into the record-context AAD, so editing a policy breaks decryption.
• open decrypts, then enforces the policy (denial returns InvalidArgument, tampering returns Decrypt). peek reads the policy for UIs.
• This is a guard for services, not enforcement against a root-key holder. Zero-knowledge model, no override key.
• Tests: allow, deny on attributes, deny on time, policy tamper, parser junk.