The CLI is the judge: compiling an org policy into a real `agents-cli` extension

Google shipped an Extension System for agents-cli in v1.5.0. One YAML file in a directory, picked up...