Reworked handling of the managed-settings policy helper during a session

Managed settings are rules an organization's administrator sets for Claude Code, and a policy helper helps enforce them. Switching that helper on partway through a session now runs through one shared step that records a reason. A new path handles a refusal from a check that ran in place of the usual one: Claude Code hands the refusal to the handler set up when it started, or keeps it for that handler, and stops switching the helper on mid-session.