wangfengcsu
210540dbb6
feat(execpolicy): layered permission rulesets — defaults+agent+user (closes #415)
Add RulesetLayer enum (BuiltinDefault < Agent < User) and Ruleset struct
so the engine can stack multiple named permission layers. Higher-priority
layers shadow lower ones; within a layer, longest matching prefix wins.
- ExecPolicyEngine::with_rulesets() builds from explicit layers
- add_ruleset() inserts and re-sorts by priority
- resolve_prefixes() merges all layers + legacy flat lists
- Existing new(trusted, denied) constructor unchanged — backward compatible
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>