feat(policy): implement hot-reloading for workspace policies

This change eliminates the need for a CLI restart when a user accepts new or
changed project-level policies. Workspace rules are now dynamically injected
into the active PolicyEngine instance.

Key improvements:
- Added Config.loadWorkspacePolicies() to handle mid-session rule injection.
- Fully encapsulated acceptance and integrity logic within PolicyUpdateDialog.
- Integrated centralized keybindings (Command.ESCAPE) for dialog dismissal.
- Refactored PolicyIntegrityManager tests to use a real temporary directory
  instead of filesystem mocks for improved reliability.
- Updated copyright headers to 2026 across affected files.
- Added UI snapshot tests for the policy update dialog.

Addresses review feedback from PR #18682.

packages/cli/src/ui/components/DialogManager.tsx

@@ -167,16 +167,12 @@ export const DialogManager = ({
       />
     );
   }
-  if (
-    uiState.isPolicyUpdateDialogOpen &&
-    uiState.policyUpdateConfirmationRequest
-  ) {
+  if (uiState.isPolicyUpdateDialogOpen) {
     return (
       <PolicyUpdateDialog
-        onSelect={uiActions.handlePolicyUpdateSelect}
-        scope={uiState.policyUpdateConfirmationRequest.scope}
-        identifier={uiState.policyUpdateConfirmationRequest.policyDir}
-        isRestarting={uiState.isRestartingPolicyUpdate}
+        config={config}
+        request={uiState.policyUpdateConfirmationRequest!}
+        onClose={() => uiActions.setIsPolicyUpdateDialogOpen(false)}
       />
     );
   }