De-fork spike S3: HardPolicy kill gate (non-bypassable DDL denies at every dispatcher)

まず packages/opencode/src/altimate/policy/hard-policy.ts と、session/prompt.ts、session/tools.ts、tool/batch.ts、effect/app-runtime.ts で指定されている dispatcher の箇所を読みます。18 テストのバイパスマトリクスを実行します。完了の条件は、一覧にあるすべての dispatcher が hook 後の最終引数を検査し、拒否が fail closed かつ terminal に失敗し、監査オラクルが通ることです。

Stage S3 of the de-fork spike — the kill gate. Enforce non-bypassable hard denies (sql_execute DDL: DROP DATABASE/SCHEMA/TRUNCATE; bash DDL) at EVERY model-invoked tool-execution dispatcher, preserving today's behavior (these already block; S3 relocates them to one audited chokepoint).

• NEW `packages/opencode/src/altimate/policy/hard-policy.ts` — pure/synchronous/total `HardPolicy.check()`; malformed args fail closed (policy_internal_error), never throws/implicit-allows. Emits a structured audit record per call (the oracle — NOT the trace).
• HardPolicy.check inserted before tool.execute at all active + latent dispatchers (D1/D2/D6 in session/prompt.ts, D3/D4 in session/tools.ts, D5 in tool/batch.ts) + fail-closed init in effect/app-runtime.ts.
• Fixes a real bypass: the fork's resolvers discarded `tool.execute.before`'s return value, so a before-hook that mutated args (SELECT -> DROP DATABASE) executed the mutation unchecked. S3 captures the post-hook FINAL args and checks THOSE.
• 18 tests (bypass matrix): allow-all config still denies; near-miss controls run; deny is terminal (execute + tool.execute.after skipped); audit oracle asserted.

This is a security boundary + the spike's decision checkpoint. HELD for human go/no-go — do not auto-merge.