bug(core): insecure user/workspace policy dirs skip permission checks (policy/config.ts)

## What happened?

`packages/core/src/policy/config.ts:199-215` only permission-checks the system policy dir:

```ts
const isSystemPolicy = normalizedDir === systemPoliciesDir;
if (isSystemPolicy) {
const { secure, reason } = await isDirectorySecure(dir);
```

Per the comment, `--policy`, workspace, user, and admin-supplemental paths skip `isDirectorySecure()`. A world-writable `~/.gemini/policies/*.toml` with `decision="allow"` loads silently.

## What did you expect to happen?

Apply `isDirectorySecure()` to every tier (warn + skip insecure dirs, or require user ownership), with a `policyIntegrity` check for the workspace tier. At minimum log which tier each loaded policy came from.

## Client information

- Repo `google-gemini/gemini-cli` @ `main` `9c1b0a610`
- Area `packages/core/src/policy/config.ts:193-219`
- Platform: all (file-permission trust boundary)

## Login information

N/A — local policy loading; repro with mode `0o777` policy dir + `decision="allow"` rule asserting it is skipped.

## Anything else we need to know?

Fix direction: move the secure check outside the `isSystemPolicy` branch; add unit tests for world-writable user/workspace dirs. Fits #29115 permission-check track.

Start in packages/core/src/policy/config.ts:193-219 and trace how system, workspace, user, --policy, and admin-supplemental directories are loaded. Review the existing isDirectorySecure() and workspace policyIntegrity handling, then add unit coverage for world-writable user and workspace directories. Done means insecure directories are warned about and skipped, and loaded policies identify their tier.

Written by the indexing model from the issue text.