[E7-T3] Verify the installed default-deny policy

## Outcome

the installed control plane begins with an inspectable policy that distinguishes privileged control-plane actions from ordinary task submission.

## Delivery contract

- **Parent Epic:** #11 (E7)
- **Size:** S
- **Depends on:** #45 (E7-T2), #27 (E2-T2)
- **Wave:** Wave C - Credible delivery
- **Sequence:** 703

## Acceptance criteria

- the seeded policy allows the configured Team A action and denies unmatched actions/Team B; task submitters cannot run privileged install/policy operations through ordinary ClaimRequests; installed policy ID/version is queryable and appears in decision evidence.

## Quality gate and evidence

- G4 plus allow/deny control-plane checks and policy evidence output.
- Record exact commands/artifacts in the PR; prose-only confirmation is not evidence.

## Non-goal

- delegated administration, live policy editor, or self-service policy changes.

## Definition of Done

- Acceptance behavior and its named negative case are observable.
- Focused checks and the repository baseline pass, or an explicit blocker is recorded.
- A teammate can reproduce the evidence.
- The change remains inside the parent Epic and architecture boundary.

Start by tracing the policy installation and decision paths described in dependencies #45 and #27, then follow ordinary ClaimRequests and the control-plane checks. Verify the seeded Team A allow case, unmatched and Team B denials, and that privileged install or policy operations cannot run through task submission. Done means policy ID/version and decision evidence are queryable, with reproducible commands and artifacts recorded.

Written by the indexing model from the issue text.