den: declare value-conditional policy codomains (binds, suppresses)

[sini]

Two den policies emit their codomain from value-conditional bodies, so any analysis that discovers a policy's codomain by firing it at a value-less probe takes the false branch and observes nothing. This declares the codomain as data on the policy record instead:

• env-to-hosts becomes a policy record carrying binds = [ "accessGroups" ] — its member emission binds accessGroups, gated on the host's environment matching, which a probe entry never does.
• drop-user-to-host-on-droid becomes a policy record carrying suppresses = [ "user-to-host" ] — its exclusion fires only where host is bound to a droid target.

Both were bare lambdas; a lambda has no field to carry a declaration, so each becomes the { __isPolicy = true; …; fn } record form. den's policy type checks __isPolicy and its merge preserves extra fields, dispatch reads only .fn — verified inert under the current den pin:

• Full multi-surface eval capture (users/groups/config-name lists/syncthing folders per host) is byte-identical before and after.
• Sensitivity control: neutralizing the binding under test moves 13 of those surfaces, so the identity is not instrument blindness.
• Liveness: replacing a record's fn with a throw propagates — the record form registers, type-checks, and dispatches.
• The droid exclusion still fires with the declaration in place (verified via the error-fingerprint contrast that flips when the exclusion is disabled).

The declarations become load-bearing at the den v2 pin bump, where the compile layer consumes a declared codomain directly instead of probing the body.