feat(policy): add runtime baseline conflict controls

[elezar]

Summary

Adds explicit filesystem policy controls for runtime baseline conflicts as an alternative to #1522. The default permits /proc read-only to read-write promotion for runtime baseline needs, while other conflicts such as device-node promotions require explicit policy opt-in.

Related Issue

Resolves #1486
Alternative to #1522.

Changes

• Adds filesystem_policy.runtime_baseline_conflicts.read_only_to_read_write with reject_unlisted, promote_all, and reject_all modes.
• Defaults omitted configuration to reject_unlisted with /proc in allow_promotion.
• Rejects unlisted runtime baseline read-only to read-write conflicts and surfaces the startup error through policy enrichment.
• Adds a follow-up commit that normalizes baseline conflict path comparisons and promotion patterns.
• Updates policy schema and security architecture docs.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-1629.docs.buildwithfern.com/openshell