Add shared policy contract roadmap with AgentFence

[dgenio]

Problem

agent-kernel and AgentFence both enforce tool-call policy at different integration points: agent-kernel is embedded in-process inside an agent runtime, while AgentFence gates tool calls externally at the MCP/process boundary.

The README already explains the distinction, but adopters will want to know whether one policy intent can be expressed and verified across both layers.

Goal

Document and track the shared policy contract roadmap from the agent-kernel side.

Scope

• Map agent-kernel policy concepts to AgentFence policy concepts.
• Identify shared vs implementation-specific policy fields.
• Define portable compatibility fixtures.
• Clarify how capability tokens and in-process principal context relate to external proxy decisions.
• Identify whether shared schema/contracts belong in weaver-spec.

Acceptance criteria

• agent-kernel docs include a shared-policy roadmap section or page.
• The docs explain how to use agent-kernel and AgentFence together without duplicating policy logic unnecessarily.
• At least one example policy intent is shown across both systems.
• Follow-up implementation/conformance issues are identified.

[dgenio]

Closing as consolidated. The shared-policy direction is now represented by #111 for the concrete Weaver/AgentFence contract work and #279 for the broader external authorization-provider seam; merged PR #276 also makes “bring your identity/policy” part of the public roadmap/security contract. Keeping a third roadmap-only issue would split ownership.