Preview /api/request's verdict (a dry run of its one pass)

Previews what POST /api/request would decide for the authenticated credential, through the same pass: the same detector evaluation and the same anchored enforcing seam. A policy is tested against the engine that enforces it (PRD v11 §1 item 10). It records no decision: no audit_logs row, no enforce-decision count, no circuit-breaker violation and no signed decision. The shared engine's evaluation that feeds the pass still counts in its metrics, and where the engine carries an audit queue a matched block is logged to policy_violations, as before v11.0.0.

Changed in v11.0.0 (#4253). It used to preview two legacy passes and resolve the governance segments of the body's user_email. It now decides for the credential that authenticated the call (subject_type Client): on Community as /api/request decides a request that carries no user token; on Enterprise, where /api/request requires a user token, as the credential's service identity, the way /api/v1/decide decides a token-less caller - and it is refused 401 where the organization requires a user token, as decide refuses it. user_email is accepted and ignored (a body field is not a principal), segments_resolved is no longer in the response, and the response gains engine, subject_type and policy_bundle. Where the anchored engine cannot decide, the preview answers 503, as the route does.