Validate domain ISC pack ids, restrict SIR_POLICY_PATH, and enforce ISC schema

[SDL-HQ]

Motivation

• Prevent loading of malformed or unsafe pack identifiers by validating load_domain_pack input.
• Reduce risk of arbitrary file access when SIR_POLICY_PATH is set by constraining it to the repository policy directory.
• Ensure ISC schema violations always block requests rather than being conditional on strict_isc.

Description

• Add regex validation in load_domain_pack to allow only [A-Za-z0-9_-] and raise ValueError for invalid ids.
• Make validate_sir always build a block on an invalid ISC structure by removing the strict_isc guard around that check.
• In _load_policy_dict compute policy_dir from _default_policy_path() and require SIR_POLICY_PATH to resolve inside that directory, raising PolicyLoadError otherwise.
• Clarify comment explaining the security boundary and guidance for operators wanting a custom policy location.

Testing

• Ran the project test suite with pytest, and all tests completed successfully.
• No new tests were added for these changes.

---

Codex Task