feat(policy): ledger-verified effective_enforcement clamp against on-disk tampering

[fu351]

Slice

• Feature / Slice: F10 follow-up — Blocking prerequisite for runtime enforcement consumption: policies.yaml tamper detection for the enforcement fields #81 (read-side enforcement tamper clamp)

What this PR does

Adds drift.effective_enforcement() — the single sanctioned way to turn the on-disk enforcement fields into the state to act on, closing the gap named in #81: once the engine honors PolicyDoc.enforcement, hand-editing .doberman/policies.yaml to enforcement: off would silently bypass the whole apply_enforcement_change gate.

• A soften (monitor/off) is honored only when the append-only ledger holds a matching APPROVED change: state, expiry (both directions — a hand-deleted expires_at that would make a temporary soften permanent is also caught), and any non-default revert target.
• Anything else — mismatch, missing ledger, garbage value, DB error — fails closed to enforce with a redacted observer anomaly + log warning (no ledger write: the ledger records gate-approved changes only).
• Raise-only: never returns weaker than the on-disk claim; an expired soften reverts, with a weaker-than-monitor revert clamped up to enforce.
• The common enforce path returns with zero I/O (runs on every mediated action).
• PolicyDoc.enforcement docstring now directs consumers to this helper; README roadmap line updated.

Closes #81

Tests added (run in CI)

• tests/unit/test_enforcement_tamper_check.py (13 tests): approved soften honored · hand-edit without ledger row clamped · denied-attempt rows don't legitimize · state mismatch clamped · garbage value clamped+anomaly · enforce resolves with zero I/O (nonexistent repo root) · expired soften reverts to verified target · off revert clamped up on expiry · future expiry keeps the soften · hand-deleted expiry after a temporary soften clamped · gate-approved expiry clear honored · DB explosion fails closed · exploding observer can't break the clamp

Security checklist

• Fails closed on error / uncertainty
• No secret, full file, or unredacted prompt logged or committed
• Any guardrail/learning change is raise-only (no silent loosening)
• Every BLOCK/AUTH carries reason codes + a human explanation (N/A — no decision-path change; the anomaly event carries a human-readable reason)

Edge cases covered / Deviations from plan / Risks introduced

• Deviation from the recovered agent implementation: the expiry ledger check was one-directional (only when on-disk expires_at was set). Made it symmetric so deleting the expiry line by hand can't make an approved temporary soften permanent; ledger encodings "None"/"(absent)"/no-row all normalize to "no expiry approved".
• Known trade-off (fail-closed direction): a soften whose expiry was cleared outside the gate is clamped to enforce until the operator re-runs the gated change — protection can only go up.
• No engine consumption yet: wiring effective_enforcement into the decision path is the follow-up this clamp unblocks (Wire the mode dial (doberman mode / setup) through log_change so mode changes hit the ledger #79/Redact the free-text reason before it reaches the drift ledger and DriftObservers #80 lineage).