chore: deprecate policies/default.yaml — registry-first first-boot policy

[knhn1004]

Why

Per docs/guide/policies.md (merged in PR #47), the project pivoted to a registry-first policy story — operators install rules from `openagentlock/rules` instead of inheriting five hardcoded gates from a bundled YAML. This PR finishes that pivot at the file/Dockerfile/README level.

What

• Delete `policies/default.yaml`. No longer the source of truth.
• Dockerfile — drop the `COPY policies/default.yaml` and the `AGENTLOCK_POLICY=...` env. Add a comment explaining the registry-first expectation.
• `control-plane/cmd/control-plane/main.go` — keep the minimal in-binary fallback (single `rogue.destructive-bash` gate, monitor mode) so a zero-conf `docker run` still has some policy to attest sessions against. Comment updated to point operators at `agentlock rules sync` + `agentlock rules install`.
• README.md — replace the "five gates" table with a "Policy — registry-first" section walking through `agentlock rules sync` + `agentlock rules install` + private-registry tap.
• docs/index.md — gate-card for "Five baseline gates" rewritten to "Registry-first policy".
• docs/guide/policies.md — "The five built-in defaults" subsection rewritten to "First-boot policy" with a recommended starter set of registry installs.

Backward compat

• A daemon with no `AGENTLOCK_POLICY` env still starts cleanly. Existing deployments that mount `policies/default.yaml` and pass `AGENTLOCK_POLICY=/path` continue to work — the loader still honors the env var; only the bundled file goes away.
• Existing custom policy files: zero impact.
• Anyone reading `policies/default.yaml` from the docker image: this path is gone. Need to either pin a version, vendor the old YAML, or migrate to `agentlock rules install`.

Test plan

• `go vet ./...` clean (control-plane)
• `bun run typecheck` clean (cli)
• `mkdocs build --strict` clean
• CI green
• Manual: `docker run ghcr.io/openagentlock/agentlockd:latest` boots without AGENTLOCK_POLICY set, falls back to in-binary policy

🤖 Generated with Claude Code