feat(cli): mcp-runtime access explain — policy what-if dry-run

## Summary

New CLI command that evaluates a hypothetical request against a policy and explains the decision:

```
mcp-runtime access explain --server workspace-assistant \
--human alice --agent claude-code --tool write-file
# → decision: deny (403)
# reason: tool_denied
# matched grant: contractor-readonly (tool rule: write-file → deny)
# policy revision: sha256:abc123…
```

## Motivation

`pkg/policy.Authorize` is a pure function — operators should be able to ask "what would happen?" without sending real traffic. This is the explainability gap every commercial control plane fills (OPA replay, Cerbos tests, Linkerd diagnostics). Pairs with matched-grant attribution (#308): explain output and audit events use the same vocabulary.

## Scope

- `internal/cli/access/` subcommand `explain`
- Inputs: identity flags (`--human`, `--agent`, `--team`, `--session`), `--tool`, `--rpc-method` (default `tools/call`)
- Policy source: live rendered policy from the cluster (default) or `--policy-file ` for proposed changes
- Output: decision, status, reason, matched grant + rule, matched session, trust context (admin/consented/effective), policy revision
- `--json` for scripting
- Golden tests for help output per repo convention

## Stretch (separate follow-up if large)
- `--replay --since 24h`: re-evaluate recent audit events from ClickHouse against a candidate policy file and diff outcomes

## Acceptance criteria
- [ ] Explain works against live policy and against a local policy file
- [ ] Output names the matched grant/rule using the same fields as audit events
- [ ] Exit code reflects decision (0 allow, 1 deny) for CI usage
- [ ] Golden test coverage for CLI help

🤖 Generated with [Claude Code](https://claude.com/claude-code)