New compliance/federation restriction checks with pre-remote-config hinting

What

A new compliance/federation enforcement mechanism was added:

• New helper functions implement checks around "compliance_taints" and restriction keys prefixed enforce_/require_, plus a new ANTHROPIC_FEDERATION_RULE_ID environment variable used to build a federation cache key.
• The feature-gate check that runs when a cached permission value is missing was reworked to first consult a new set of session-local "hinted" denials and compliance taints before remote config has even loaded, gated behind an internal check that requires first-party Anthropic authentication.

Why

This lets organization-enforced compliance restrictions apply immediately, even before the remote configuration that normally carries them has finished loading, closing a gap where early actions could bypass a restriction.