Fail-closed test matrix: missing / mismatched / stale / peer-supplied token policy

[cryptskii]

Doctrine .github/instructions/token-policy-readiness.instructions.md §3/§6: prove transfers fail closed (no balance mutation) for missing policy, mismatched policy_commit, stale readiness, and peer-supplied policy across online + offline. Layer B.