fix(core): variable substitution does not recurse — nested `{{var.x}}` silently produces wrong verdicts

core/policy_parameterization.py:22-25 walks one level and continues on any non-str;
not_found_vars stays empty so no error is raised. A {{var.x}} inside a nested condition.value
reaches the evaluator as a literal string — in the NotEquals direction the policy returns true
while the resource holds the forbidden value, with errors: []. Harmless today only because no
shipped feature nests values; the planned select/transform/AnyElement features all make it
reachable.

Fix. Recurse into dicts/lists, or reject a {{var. literal in a nested value in the engine
(not in tui/validate.py, which the CLI path never calls).

Start at core/policy_parameterization.py:22-25 and trace how nested condition.value data reaches the evaluator; do not use tui/validate.py because the CLI path bypasses it. Implement the stated nested-value handling or rejection behavior, then verify that a nested {{var.x}} no longer produces a silent wrong verdict or an empty errors list.