Design signed team policy distribution

## Problem

Teams may need centrally managed protection requirements, but the policy model and user experience need a clear design before implementation.

## Questions

- How are destination rules, required plugins, trusted publishers, file limits, and compatibility exceptions represented?
- Which rules may a project strengthen, and which may it weaken?
- How are policy bundles signed, distributed, cached, updated, and rolled back?
- How does Pentect explain the effective policy without exposing sensitive configuration?
- What is the smallest useful team feature that does not introduce enterprise-only complexity?

## Status

Design exploration only; implementation remains deferred until these questions are resolved.

No files, tests, or entry points are identified. Start by resolving the listed policy-model, precedence, signing, distribution, caching, rollback, and user-experience questions. Done means a focused design defines the smallest useful team feature and settles implementation scope.

Written by the indexing model from the issue text.