feat(policy): implement project policy integrity verification

Adds a security mechanism to detect and prompt for confirmation when project-level policies are added or modified. This prevents unauthorized policy changes from being applied silently.

- PolicyIntegrityManager calculates and persists policy directory hashes.
- Config integrates integrity checks during startup.
- PolicyUpdateDialog prompts users in interactive mode.
- --accept-changed-policies flag supports non-interactive workflows.
- toml-loader refactored to expose file reading logic.

packages/cli/src/ui/components/DialogManager.tsx

@@ -37,6 +37,7 @@ import { AgentConfigDialog } from './AgentConfigDialog.js';
 import { SessionRetentionWarningDialog } from './SessionRetentionWarningDialog.js';
 import { useCallback } from 'react';
 import { SettingScope } from '../../config/settings.js';
+import { PolicyUpdateDialog } from './PolicyUpdateDialog.js';
 
 interface DialogManagerProps {
   addItem: UseHistoryManagerReturn['addItem'];
@@ -166,6 +167,19 @@ export const DialogManager = ({
       />
     );
   }
+  if (
+    uiState.isPolicyUpdateDialogOpen &&
+    uiState.policyUpdateConfirmationRequest
+  ) {
+    return (
+      <PolicyUpdateDialog
+        onSelect={uiActions.handlePolicyUpdateSelect}
+        scope={uiState.policyUpdateConfirmationRequest.scope}
+        identifier={uiState.policyUpdateConfirmationRequest.policyDir}
+        isRestarting={uiState.isRestartingPolicyUpdate}
+      />
+    );
+  }
   if (uiState.loopDetectionConfirmationRequest) {
     return (
       <LoopDetectionConfirmation