refactor(server): unify policy persistence in objects table

[johntmyers]

Summary

This PR moves sandbox policy revisions, draft policy chunks, and settings persistence onto the unified objects table for the greenfield OS-103 schema.
It replaces the old dedicated policy/chunk tables, switches singleton settings writes to name-based upserts, and adds handler-level coverage for the draft chunk lifecycle.

Related Issue

Linear: OS-103

Changes

• replace the Postgres and SQLite migration baselines with a unified objects schema and remove the old 002/003 policy-specific migrations
• add PolicyRevisionPayload and DraftChunkPayload wrappers in the proto layer and update persistence backends to store policy revisions and draft chunks inside objects
• change settings persistence to upsert singleton records by name, update sandbox teardown cleanup, and tighten CAS retry logic to use typed unique-constraint handling
• add handler-level draft chunk lifecycle coverage and fix the Rust/Python e2e regressions uncovered while exercising inference routing locally

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Commands run:

• cargo fmt --all -- --check
• RUSTC_WRAPPER= cargo test -p openshell-server persistence::tests -- --nocapture
• RUSTC_WRAPPER= cargo test -p openshell-server sandbox_settings_save_and_load_round_trip -- --nocapture
• RUSTC_WRAPPER= cargo test -p openshell-server delete_unlock_sandbox_set_succeeds_after_global_delete -- --nocapture
• RUSTC_WRAPPER= cargo test -p openshell-server draft_chunk_handler_lifecycle_round_trip -- --nocapture
• RUSTC_WRAPPER= cargo test --manifest-path e2e/rust/Cargo.toml --features e2e --test host_gateway_alias -- --nocapture
• RUSTC_WRAPPER= UV_NO_SYNC=1 uv run pytest python/openshell/sandbox_test.py -k no_verify
• user-ran RUSTC_WRAPPER= mise run e2e:rust
• user-ran RUSTC_WRAPPER= mise run e2e:python

mise run pre-commit was attempted but is still blocked locally by two non-branch issues: ignored architecture/plans/* files without SPDX headers and the workspace openshell-prover test link step failing with ld: library 'z3' not found.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[johntmyers]

/ok to test ed81ed9