Support a default egress policy in ActorTemplate

## Summary

Allow an `ActorTemplate` to define the initial egress policy for Actors created from it.

Today, every Actor starts without an egress policy and callers must create the policy separately. Templates should be able to provide a default when most Actors created from the template need the same access.

## Proposed behavior

Add an optional policy block to `ActorTemplate`. The block contains egress rules but no resource metadata.

When an Actor is created from the template:

- If the block is present, create the Actor's `default` egress policy in the same operation.
- Set the policy Atespace from the Actor and its name to `default`.
- Generate the policy UID, version, and timestamps normally.
- If the block is absent, preserve the current behavior and create no policy.
- Validate the template block using the same validation as an `EgressPolicy`.

The policy is copied at Actor creation time. It is not inherited dynamically: later template changes do not affect existing Actors, and callers may update or delete the Actor's policy normally.

Actor and policy creation should be atomic so an Actor is not left without its configured default policy after a partial failure.

## API sketch

```proto
message ActorTemplate {
// Existing fields...

// Initial egress policy for Actors created from this template.
EgressPolicyTemplate default_egress_policy = 9;
}

message EgressPolicyTemplate {
repeated EgressRule rules = 1;
}
```

The separate template type avoids embedding `EgressPolicy` resource metadata where it has no useful meaning.

## Acceptance criteria

- Creating an Actor from a template with a policy creates its `default` policy.
- Creating an Actor from a template without one creates no policy.
- Invalid policy rules cause ActorTemplate validation to fail.
- Updating or deleting the Actor's policy does not affect the template.
- Actor creation cannot partially succeed without its configured policy.