fix: enforce zone policy after phase output

[ApexWorm]

Problem

Generated migrations are classified correctly, and generated-zone policy skips smell and structural detectors. However, some phase output was admitted after individual phase filtering, so generated migration findings could persist and enter the execution queue.

Fix

Apply one normalized issue-level zone-policy gate after phase execution and before issue context is stamped. Add a queue-level defense for historical persisted findings whose stored zone and detector are already policy-skipped.

Verification

• 40 queue and plan tests passed
• 23 zone-policy tests passed
• Agent verification: 63 focused tests passed
• Agent verification: full suite had 5,812 passed and 4 skipped; two unrelated existing duplicated review-prompt assertions failed
• Ruff and diff whitespace checks passed