refactor: Move guard-policy parsing, AllowOnly factory, and DIFC sink state to proper packages#1987

lpcox merged 4 commits intomaingithub/gh-aw-mcpg:mainfrom

copilot/refactor-semantic-function-clustering-againgithub/gh-aw-mcpg:copilot/refactor-semantic-function-clustering-againCopy head branch name to clipboard