Epic: Hardening pass and fixes

I'm going through the critical flows as thoroughly as possible and writing some new tests to try to catch weird edge cases up front. This is just documenting the work that I'm doing and batching the resulting issues / fixes in one place.

Each of these should result in new tests being added to prevent regressions:

• Check engine and matcher
• Scope parser fuzzing
• Check internal API for privilege escalation
• Check REST API full matrix
• Check concurrency & cache race conditions
• Check policy file handling and management commands

Issues found so far (all low severity, or proactive cleanup / nits):
#301
#302
#303
#304
#306