fix(agent): fail closed on policy-pack retrieval errors

[sheawinkler]

Summary

• fail closed when scoped policy-pack retrieval has transport, empty-body, JSON, or response-shape failures
• preserve upstream warnings and add the canonical degraded-memory directive to every degraded outcome
• add regression coverage and a reproducible v4.0.8 eval ledger, including a response larger than SC_ARG_MAX

Local verification

• python3 scripts/tests/test_agent_policy_pack.py (7 tests, 15 response cases)
• shellcheck -x -P scripts/agent_hooks scripts/agent_hooks/agent_policy_pack.sh
• Python syntax and JSON validation
• git diff --check
• changed-file public-boundary scan and full-tree public guard