fix(cli): report malformed policy files cleanly

[rioyu123]

Summary

Malformed, non-UTF-8, deeply nested, or unreadable bundled and custom policy files now follow a path-specific error contract. The CLI converts those failures into concise Click errors instead of exposing raw parser, decoder, recursion, or I/O exceptions.

The change uses one private loader helper for both policy paths, preserves the original exception as the cause, keeps FileNotFoundError behavior unchanged, and does not fall back to a default policy after an explicit invalid --policy input.

Fixes #128.

Verification

• I am familiar with the Contributing Guidelines
• Added or updated focused tests
• Updated documentation for user-visible changes
• Ran repository-wide Ruff lint
• Full local pytest suite passes on Windows
• Ran the package build
• Did not add credentials, private datasets, or proprietary benchmark content

Focused verification:

• 14 policy, golden-behavior, and CLI regression tests passed
• repository-wide Ruff check passed
• wheel build completed successfully
• a broader 57-test policy/CLI selection had 56 passes and one pre-existing Windows-only path-separator assertion (\\tmp\\run versus /tmp/run)
• the earlier full Windows suite reached 45% with unrelated POSIX path/symlink failures, then stalled in Harbor tests at about 3.3 GB with no CPU progress and was interrupted; CI is the authoritative Linux run

Release Impact

• No user-visible release note needed
• Updated CHANGELOG.md