P1: Add @ageflow/mcp-policy package for allowlists and config isolation

[Neftedollar]

Context

@ageflow/mcp-server needs a reusable policy layer so authz, allowlists, and config isolation are not duplicated across CLI, stdio, and HTTP transports.

Problem

Today policy decisions are implicit or embedded in server/runtime code. That makes it hard to:

• isolate MCP config per workflow/client
• validate allowed workflows/tools/roles before server startup
• share policy logic between stdio and HTTP transports
• keep default-deny behavior obvious and testable

Scope

• Add a dedicated @ageflow/mcp-policy package.
• Define policy types for:
  • workflow allowlists
  • tool allowlists
  • role allowlists
  • config isolation boundaries
• Add validation and normalization helpers for policy config.
• Make policy evaluation reusable by @ageflow/mcp-server and CLI transport setup.
• Keep defaults explicit and deny-by-default.

Acceptance Criteria

• Policy config can be loaded and validated independently of the server.
• Tool/workflow/role allowlists are enforced from a single shared policy module.
• A failing policy produces structured, machine-readable errors.
• Tests cover both valid and denied policy paths.

Non-goals

• External IAM provider integrations.
• UI for policy editing.
• Broad security redesign outside MCP policy scope.

Relationship

• Foundation for P1: Implement per-tool/per-workflow AuthZ for HTTP transport #246 (Per-tool/per-workflow AuthZ for HTTP transport).
• Also useful for future multi-workflow and remote transport work.