#3763 feat: Policy enforcement at the contract level

A workflow contract gets one setting, spec.policies.gate, that enforces all of its policies. Enforcement also only tightens: the organization, the contract, a policy group attachment, or a policy attachment can turn enforcement on, but no level can turn off enforcement from a higher level. This removes the documented opt-out of gate: false under organization enforcement. The change ships in the next release, with no warning period.

There are no open questions. Reviewers should check these decisions in particular:

• D-002: enforcement only tightens, at every level (breaking change to documented behavior)
• D-004: the change ships right away, with no warning period
• D-006: the control plane flags runs from older CLIs that ignore the contract setting

We would like two reviewers to approve this spec before it merges.

Refs #3762

AI disclosure: this spec was drafted with assistance from Claude Code.