Fail std policy validation when its search tool fails

The policy script appends `|| true` to its rg searches. That treats tool errors like normal no-match results. If rg is absent, each search emits a shell error but the resulting empty strings leave `failed=0`, allowing the script to print OK. Unreadable-path/search errors are similarly masked. A required check should not report success when it could not inspect its inputs.

Code evidence:

- [tools/check_std_policy.sh:12](https://github.com/wavefnd/Wave/blob/ea74c2dafc31da876e5561f2d176ba719f5a0458/tools/check_std_policy.sh#L12)
- [tools/check_std_policy.sh:34](https://github.com/wavefnd/Wave/blob/ea74c2dafc31da876e5561f2d176ba719f5a0458/tools/check_std_policy.sh#L34)
- [tools/check_std_policy.sh:46](https://github.com/wavefnd/Wave/blob/ea74c2dafc31da876e5561f2d176ba719f5a0458/tools/check_std_policy.sh#L46)

Acceptance:

- [ ] Check required tool availability and distinguish rg exit 1 (no matches) from execution/search failures.
- [ ] Ensure missing rg and an injected search failure produce a nonzero status and useful message.
- [ ] Keep a no-match clean tree successful and real policy matches failing.
- [ ] Use small shell fixtures or a stub search command; no Wave compiler, LLVM build or network is needed.

Audit status: static source inspection against canonical master `ea74c2dafc31da876e5561f2d176ba719f5a0458` on 2026-09-10. No compiler build, test execution, implementation change or local reproduction was performed for this report. The examples describe the source-derived behavior to verify when implementing the fix.

Start in tools/check_std_policy.sh at lines 12, 34, and 46, then trace how each rg result affects the failed status. Use the suggested small shell fixtures or a stub search command to verify missing rg, search failures, clean no-match input, and real policy matches. Done means execution failures return a nonzero status with a useful message while no matches remain successful.

Written by the indexing model from the issue text.