WEB-33: establish v0.4 policy acceptance baseline

[JS-mark]

Closes WEB-33

Summary

• add the v0.4 roadmap-to-test traceability matrix with stable P0/P1 automation IDs
• add reusable read/write/safe-write/metadata-less fixtures and lock the no-policy baseline
• remove --passWithNoTests from the CLI test gate
• reconcile the matrix with ADR-033's final withPolicy API, setup/runtime errors, evaluation priority, metadata/limit semantics, MCP payload, and inspect summary contract

ADR-033 review

• preserve every original P0 behavior assertion and add executable coverage IDs for immutable config, invalid setup, UTF-8 output limits, and non-policy exception propagation
• make the first-violation rule explicit for combined safety requirements
• distinguish metadata-dependent fail-closed behavior from valid metadata-less tool-name policies
• record empty tools as valid and duplicate names / invalid config as setup failures

Verification

• pnpm turbo run build test typecheck lint — 30/30 tasks passed
• 29 test files, 134 tests passed
• CLI tests run with vitest run — 17/17 passed
• pnpm changeset status --since=origin/main, test hygiene scan, and git diff --check passed