New HIPAA-evidence tracking now gates web-fetch and design-sync policy checks

What

• Session and organization-policy state now track HIPAA-related evidence: whether HIPAA-relevant information has been seen (hipaa_seen), seen but incomplete (hipaa_seen_incomplete), or ruled out (hipaa_ruled_out). This replaces a simpler flat list of "seen identities" with a richer evidence structure that also tracks confirm/refuse timestamps (diskConfirmedAtMs, diskRefusedAtMs) and distinguishes IO failures from content-based unusability.
• This evidence is now checked before allowing the allow_web_fetch and allow_design_sync actions; if the check fails, the policy verdict returns org_denied, a new failure path that did not exist before.
• A separate feature gate (tengu_tranquil_crescent) can also force this same check to fail immediately, hard-blocking allow_web_fetch/allow_design_sync regardless of the evidence gathered.

Why

This adds a compliance check so web-fetch and design-sync features can be denied for organizations subject to HIPAA rules until their status is properly established, closing a gap where those actions could otherwise run without that check.