Feature restriction messages and policy gates now come from one central table

What

• The per-feature deny lists that gate features under HIPAA/ZDR (data-residency compliance) modes were replaced with a single table. Every entry now carries a requirementId (e.g. HIPAA-R3, HIPAA-R37, HIPAA-R43) showing which compliance requirement it satisfies, alongside deniedUnder, onCacheMiss, label, and verb. New entries include allow_send_file, allow_heap_dump, allow_local_checkpoint_commit, allow_insights, allow_stats_transcript_scan, and allow_connector_suggest.
• Several commands that used to carry their own duplicate label/verb text now rely entirely on this shared table: the hidden heapdump command's policyGate was simplified to {policy: 'allow_heap_dump'}, the insights command dropped its separate isEnabled check and inline label/verb in favor of {policy: "allow_insights"}, and the team-onboarding command similarly dropped its redundant isEnabled and label.
• Places that build "X are unavailable"-style messages (the cloud-sessions-unavailable message, the generic policy-gate check, and the HIPAA-denied-feature helper) now call a shared helper to look up {featureLabel, verb} from the same central table instead of having those passed in separately.

Why Centralizing the label, verb, and compliance-requirement mapping in one table removes duplicated, easy-to-drift text across commands and makes clear which specific compliance requirement each restriction enforces.