Add hierarchical access policies

[trakhimenok]

What changed

• adds hierarchical, adapter-independent access and audit policies
• enforces global and context-bound capabilities across sessions, batches, queries, and transactions
• adds YAML/JSON policy codecs and explainable denial errors
• adds SpecScore Idea, Feature, and implementation Plan artifacts
• documents access policies in the root README and dedicated repository guide

Why

Extensions, tenants, jobs, analytics, and support tools need a portable least-privilege boundary that works consistently across every DALgo adapter and in-memory tests.

Validation

• access package: 100.0% statement coverage
• go test -race ./access
• go test ./...
• go vet ./...
• specscore spec lint --caller codex