Explain policy evaluation for the protection card

Calls the policy engine in dry-run mode against the agent's composed protection card and returns a structured trace + care-framed remediations. Optional enrich: true runs an LLM pass over the structured remediations to produce long-form prose; off by default. Read-style POST — no state mutation, no Idempotency-Key.

This endpoint returns a deferred Phase-5 stub (trace: null) — the dedicated protection evaluator has not landed, so no policy evaluation runs and no request field is required. request_snippet.tool_name is accepted and ignored today; when the evaluator lands it becomes REQUIRED with a 400 missing_tool_name, as on the alignment explain (MNE-5820).