[5c] Policy reason traces

[andrmaz]

What to build

Every policy evaluation (from #14) produces a structured reason trace: which rules matched, what decision was reached (allow / deny / redact), and for denied queries a machine-readable reason code. Traces are attached to the request context and emitted as a typed output for audit log consumption.

Acceptance criteria

• Policy decision traces include: rule id, matched condition, decision (allow/deny/redact), and reason code for denials.
• Traces are available on the request context object after evaluation completes.
• Denied queries include a reason code that is human-readable and machine-parseable.
• Unit tests assert trace shape for allow, deny, and redact outcomes.

Blocked by

• [5b] Policy runtime evaluator #14 [5b] Policy runtime evaluator