manifest: add access_policies key and guided access-policies command

[mihilmy]

access_policies is a JSON array of allow/deny statements that supersedes disabled_features — same off-switch, plus a resource that scopes a rule to documents matching a Purview sensitivity label. This adds the config key with structural validation, documents it in manifest.md, and adds a guided /access-policies command that walks the admin from label GUIDs to a finished array.

   ┌─ statement ──────────────────────┐
   │ effect: deny | allow             │
   │ action: <slug> | [<slug>, …]     │   slugs: addin.access · file.upload
   │ resource? ──▶ { type,            │          skills.authoring · thumbs
   │   identifiers: [ mip_label_guid  │
   │                  (equals|exists) │
   │                | mip_label_name  │
   │                  (equals|startsWith|endsWith|exists) ] }
   └──────────────────────────────────┘
     no resource  = disabled_features (off for everyone)
     resource     = scoped to labelled documents

   /access-policies (guided)            build-manifest.mjs
   1. Get-Label → GUIDs         ──▶     • invalid JSON        → fatal
   2. pick statement shapes             • bad effect / type   → warn
   3. explain matching rules            • wrong op for type   → warn
   4. read back + validate              • blank slug, empty identifiers → warn

The validator warns on exactly the shapes the add-in drops silently at runtime, so the build is the only place they're caught. Docs also gain a grammar reference + slug tables (access-policies.md, manifest.md) and the missing access_policies field in bootstrap.md.

Test plan

• node build-manifest.mjs office out.xml … access_policies='[…]' → value baked into the taskpane URL, URL-encoded; valid statements produce no warnings.
• Probes, each producing a targeted warn: naming the statement/identifier: guid + startsWith; equals: ""; empty identifiers; blank action slug; non-string description; bad effect/type; two operators; top-level object. Invalid JSON → exit 1.
• python3 scripts/check.py → 0 issues.