Modify the authorization Layer

Goal

Change the built-in builtin-auth Layer or its pure policy engine without weakening the host's fail-closed behavior.

Workflow

1. Read docs/public/authz-policy/README.md.
2. Route Layer composition, authentication, and request gating changes to ovstorage-remote/ovstorage-authz-layer/.
3. Route TOML parsing, operation mapping, rule precedence, and list filtering changes to ovstorage-remote/ovstorage-authz-policy/.
4. Keep transport-derived identity values in ovstorage-remote/ovstorage-authz-context/.
5. Preserve deny-by-default parsing, atomic policy replacement, and authorization above caches in the Stack.
6. Add focused tests in the owning crate, then run: