Extract reusable IFC policy and classify worker placement

[jmecom]

Extracts the deterministic label, domain, capability, publication, declassification, and process-reuse rules from buzz-acp into the zero-I/O buzz-ifc crate. The ACP harness remains responsible for verifying Buzz events and membership and for acting on the resulting policy decisions.

This layer also makes worker placement explicit. Public channels in one community use shared_public and may reuse the same public-bound pool. Restricted channels, DMs, group DMs, and owner-private work use domain_confined and require an exact domain match. The experimental enforcement mode is named route; isolate remains accepted as a compatibility alias.

The behavior remains off by default. domain_confined is a placement requirement for a future launcher or sandbox, not a claim that this PR provides OS confinement.

Testing:

• cargo test -p buzz-ifc -p buzz-acp (828 tests)
• cargo clippy -p buzz-ifc -p buzz-acp --all-targets -- -D warnings

Stack:

1. Audit audience-scoped IFC decisions in buzz-acp #6273: audit-only IFC evaluation
2. Route ACP workers by execution domain #6274: exact-domain ACP worker routing
3. Extract reusable IFC policy and classify worker placement #6275: reusable policy and worker placement
4. Expose IFC policy to external agent harnesses #6176: external harness broker