Policy evaluate API

POST /api/v1/kya/policy/evaluate returns a recommended verdict (local PolicyEngine + optional OPA pack allowlist + session risk + session clearance).

A tool above the session's Read / Build / Deploy box is DENY with SESSION_CLEARED.

Callers must still enforce gates; this endpoint does not perform side effects. Dashboard playground: /app/kya/policy.