Promote AgentCompany-New to the repository root and retire the old app

The legacy application - its src, tests, landing site, promo assets, docs,
release tooling, CI workflows, and root configs - leaves the tree; it stays
reachable in history. Everything under AgentCompany-New moves up unchanged:
same package name, so the production userData/database path is untouched,
and e2e/build scripts already resolved paths relative to the project. The
developer cred.txt stays gitignored at its new location. Full verify:ci
passes from the new root.

src/main/services/policy-service.ts

@@ -0,0 +1,48 @@
+import type { DatabaseSync } from "node:sqlite";
+import type { RiskLevel } from "../../shared/domain";
+import { RISK_LEVEL } from "../../shared/domain";
+import { createId } from "../../shared/ids";
+
+const RISK_RANK: Record<RiskLevel, number> = {
+  [RISK_LEVEL.LOW]: 0,
+  [RISK_LEVEL.MEDIUM]: 1,
+  [RISK_LEVEL.HIGH]: 2,
+};
+
+export interface PolicyDecision {
+  approvalRequired: boolean;
+  matchedRuleId: string;
+}
+
+export class PolicyService {
+  constructor(private readonly db: DatabaseSync) {}
+
+  seedOrganizationPolicies(orgId: string, now: string): void {
+    this.db.prepare(`
+      insert into policy_rules(id, org_id, subject_type, subject_id, action, effect, risk_ceiling, created_at)
+      values (?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(createId("pol"), orgId, "organization", orgId, "task_create", "require_approval", RISK_LEVEL.MEDIUM, now);
+  }
+
+  evaluateTaskCreation(orgId: string, risk: RiskLevel): PolicyDecision {
+    const rule = this.db.prepare(`
+      select id, effect, risk_ceiling
+      from policy_rules
+      where org_id = ? and action = ?
+      order by created_at asc
+      limit 1
+    `).get(orgId, "task_create") as PolicyRuleRow | undefined;
+    if (!rule) throw new Error("Policy rule is required for task creation.");
+    if (rule.effect !== "require_approval") throw new Error(`Unsupported policy effect: ${rule.effect}`);
+    return {
+      approvalRequired: RISK_RANK[risk] > RISK_RANK[rule.risk_ceiling],
+      matchedRuleId: rule.id,
+    };
+  }
+}
+
+interface PolicyRuleRow {
+  id: string;
+  effect: string;
+  risk_ceiling: RiskLevel;
+}