Get the effective AI policy

The caller's own AI policy as it is enforced right now: the mandatory constraints applied at routing time, the per-operation class map, the resolved defaults, and whether the policy currently leaves every gating operation with a compliant route.

constraints is the enforced view: it folds the workspace policy together with the platform provider floor (constraints.platform_provider_floor), a deployment-level constraint that intersects with the tenant policy and can only narrow it. inherited: true means the workspace has stored no policy of its own and runs on the platform default.

The workspace is taken from the authenticated key and from nowhere else. A master-view key spans every workspace, has no single policy to read, and is rejected with 400 workspace_scope_required.