Tracks the Phase 1 scope from the architecture blueprint (policy kernel
+ REST, no MCP yet): ratify the five blueprint decisions, service
skeleton with default-deny policy, REST surface + CostRunRate cutover,
smoke tests and closure/handoff to Phase 2.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>