bug: invalid policy TOML rules are reported as errors but still loaded - empty toolName crashes startup

## What happened?

The policy TOML loader **collects validation errors for invalid rules but still loads and enforces them**. The validation loops push errors and `continue` (skipping only within the validation pass), while the transform loop iterates `validationResult.data.rule` unfiltered. Two concrete consequences:

1. A rule with `toolName = ""` produces the friendly "use `'*'` instead" error, yet is still transformed into a live rule with an empty name — which then makes `PolicyEngine`'s constructor throw inside `new Config(...)` (no try/catch), **crashing CLI startup** and defeating the loader's entire graceful error-collection design.
2. A rule carrying both `commandPrefix` and `commandRegex` (explicitly forbidden) is reported as invalid but enforced anyway — silently applying whichever form `buildArgsPatterns()` picks.

## Affected code

`packages/core/src/src/policy/toml-loader.ts:408-430` — validation records the error and continues:

```ts
if (toolNamesRaw.some((name) => name === '')) {
errors.push({ ..., message: 'Invalid policy rule: toolName cannot be empty string', ... });
continue; // skips only this validation iteration
}
```

`packages/core/src/policy/toml-loader.ts:455+` — transform loop has no filter:

```ts
const parsedRules: PolicyRule[] = (validationResult.data.rule ?? [])
.flatMap((rule) => { ... }); // includes rules that produced validation errors
```

Same pattern for the `validateShellCommandSyntax` failures at ~394-409 ("Continue to next rule, don't skip the entire file").

## How can this be reproduced?

Drop a policy TOML containing `[[rule]]\ntoolName = ""\ndecision = "allow"` into a loaded tier and start the CLI: startup throws from the PolicyEngine constructor despite the loader having "handled" the problem. For consequence 2, author a rule with both commandPrefix and commandRegex and observe it taking effect.

## What did you expect to happen?

Rules that fail validation are excluded from the parsed output (with their collected errors surfaced); valid rules in the same file continue to load.

## Suggested direction

Track failing rule indices during validation and filter them out before the transform loop (`data.rule.filter((_, i) => !invalidIndices.has(i))`).

---

*Found by source audit on current `main` (commit `5411f113c`); platform-independent. No open issue/PR covering this was found (searched: policy TOML invalid rule).*

Read packages/core/src/src/policy/toml-loader.ts around lines 394-430 and packages/core/src/policy/toml-loader.ts from line 455 onward. Reproduce the issue with a policy TOML containing an empty toolName, then start the CLI and inspect how validation errors and parsed rules are handled. Done means invalid rules are excluded while their errors remain surfaced, valid rules still load, and startup no longer crashes.

Written by the indexing model from the issue text.