Separate policy routing metadata

[pengfei-threemoonslab]

Summary

• Add findings[].policy_routing for policy-pack owner/reviewer/approval routing metadata and bump the report schema to 0.28.
• Remove policy routing keys from Finding.evidence so routing-only changes do not affect fingerprints, suppressions, baselines, or release decisions.
• Preserve v0.27 routing-evidence fingerprints for old baseline matching and stale-baseline checks.
• Regenerate report schema, docs/public surfaces, llms-full.txt, and sample report goldens.

Validation

• python scripts/generate_schemas.py
• pytest tests/test_policy_packs.py tests/test_schema_boundaries.py tests/test_reports.py tests/test_baseline_integrity.py tests/test_privacy.py tests/test_release_decision.py
• pytest tests/test_public_surface_contract.py tests/test_docs_links.py
• ruff check src/agents_shipgate tests tools scripts
• PYTHONPATH=src python -m agents_shipgate check --agent codex --workspace . --format codex-boundary-json

shipgate check returned decision=warn and completion_allowed=true; the warning is that skills/agents-shipgate/SKILL.md is an undeclared capability surface in shipgate.yaml, so verify cannot fully gate that surface until it is declared.