docs(policy): decide capability authorization model

[KenTaniguchi-R]

Summary

• replace task-name grants as the target authorization model with canonical subjects, resources, actions, autonomy, limits, and exact approvals
• define a pure authorization kernel plus an owner-facing share compiler with deterministic presets and explain/assert interfaces
• specify all enforcement adapters and an exhaustive zero-widening migration from current task offers

Verification

• pnpm -r build
• pnpm -r typecheck
• pnpm -r test
• acceptance review: SHIP
• security/architecture review: SHIP
• owner UX/documentation review: SHIP

Fixes #192

[KenTaniguchi-R]

CI is externally blocked before any step starts. Both Actions workflows have runner_id 0 / zero steps; the check annotation says recent account payments failed or the Actions spending limit must be increased. One rerun produced the same result. Local required gates are green (build, typecheck, full tests) and GitGuardian passes. Leaving this PR open and unmerged until billing/Actions is restored.