Policy

Policy expresses constraints: allowed_providers, allowed_regions, max_cost_per_call, max_context_size, etc. Policy is evaluated before the route is returned, not after the bill arrives. Mirrors the AgentStateGraph policy primitive so existing policy files port over.