Add shared policy contract roadmap with AgentFence #116

Problem

agent-kernel and AgentFence both enforce tool-call policy at different integration points: agent-kernel is embedded in-process inside an agent runtime, while AgentFence gates tool calls externally at the MCP/process boundary.

The README already explains the distinction, but adopters will want to know whether one policy intent can be expressed and verified across both layers.

Goal

Document and track the shared policy contract roadmap from the agent-kernel side.

Scope

• Map agent-kernel policy concepts to AgentFence policy concepts.
• Identify shared vs implementation-specific policy fields.
• Define portable compatibility fixtures.
• Clarify how capability tokens and in-process principal context relate to external proxy decisions.
• Identify whether shared schema/contracts belong in weaver-spec.

Acceptance criteria

• agent-kernel docs include a shared-policy roadmap section or page.
• The docs explain how to use agent-kernel and AgentFence together without duplicating policy logic unnecessarily.
• At least one example policy intent is shown across both systems.
• Follow-up implementation/conformance issues are identified.