audit-registry: policy registry so policy_ref resolves to something real

[joelpeace48-cell]

Problem

The attestation record carries a policy_ref hash. A hash with nothing to
resolve against is not verifiable — a compliance reviewer cannot tell what
policy governed an inference, only that some bytes were referenced.

What to do

• register_policy(policy_hash, publisher: Address, uri, effective_from).
• Policies are versioned and effective-dated; an attestation resolves against
  the version in force at its timestamp, not the current one.
• Publisher authorizes registration; policies are immutable once registered
  (publish a new version instead).
• URI points to the full text — IPFS or HTTPS. Store the hash on-chain so
  tampering with the hosted copy is detectable.
• Support policy deprecation without deletion.

Acceptance criteria

• Policy registry with versioning and effective dates
• Attestations resolve to the version in force at their timestamp
• Registered policies immutable; new versions supersede
• Tampering with the off-chain copy detectable via the on-chain hash

Notes

Effective-dating is the important part. "Which policy applied at the time" is
the question a regulator asks, and answering it with today's policy is wrong.