feat(grid-agent): enforce central action policy (#120)

docs/grid-agent-architecture.md

@@ -26,6 +26,8 @@ handles, the control sender, and observable receiver.
 | Conversation / tool calls | request owner | 256 messages / 64 calls, with lower configured limits | rejected before request |
 | LLM request slots | shared `LlmClient` semaphore | 256 hard / configured concurrent requests | async acquire or cancellation |
 | Reasoning/tool session | `ToolLoop` caller | 32 turns / 256 calls hard, with lower configured limits | total timeout, cancellation, or supersession |
+| Policy tools / approvals / schedules | `PolicyGateway` mutex | 64 tools / 4,096 approval records / 1,024 scheduler grants hard | deny before opaque authorization |
+| Principal/global resource budget | `PolicyGateway` time window | validated calls, zero L$, upload, inventory, movement, and build ceilings | atomic charge or stable denial |
 | Authorized avatars | immutable `AgentConfig` set | 1,024 hard ceiling, lower configured limit | malformed, nil, duplicate, and wildcard input rejected |
 | Configuration / secret file | loader | 64 KiB / 16 KiB | regular non-symlink file only |
 
@@ -65,7 +67,8 @@ shutdown.
   The `live-grid` feature supplies `LibremetaverseClientOwner`; live
   implementations must own it and reuse its client and managers.
 - World changes cross only `WorldMutator::apply`, which always receives the
-  proposed call and an explicit `PolicyDecision`. This issue supplies no live
+  non-forgeable `AuthorizedAction` produced by `PolicyGateway`. Raw calls and
+  caller-created decisions are not accepted. This issue supplies no live
   mutation implementation.
 - LLM traffic crosses one exact configured URL through `LlmClient`. Redirects
   are refused, response bodies are bounded while streaming, bearer secrets are
@@ -89,7 +92,9 @@ typed config/events/policy boundaries    live-grid feature boundary
 
 avatar session -> bounded ToolLoop -> exact-endpoint LlmClient
                        |
-                       +-> validated ToolExecutor boundary
+                       +-> PolicyToolExecutor -> PolicyGateway
+                                                   |
+                                                   +-> AuthorizedToolBackend
 ```
 
 The package has no build script or direct native dependency. The focused
@@ -97,3 +102,5 @@ The package has no build script or direct native dependency. The focused
 source, build scripts, and unreviewed direct dependency names in this package.
 The precise LLM compatibility and cancellation contract is documented in
 [`grid-agent-llm.md`](grid-agent-llm.md).
+The origin/capability matrix and opaque mutation boundary are documented in
+[`grid-agent-policy.md`](grid-agent-policy.md).