Move docs/ package mirror into document-navigator plugin

Relocate the ~6k-file docs tree from the repo root into
plugins/document-navigator/docs/ so the plugin is self-contained and
portable. docs/superpowers/ (specs and plans) stays at the repo root.

Moved via cp+rm rather than git mv because directory rename() fails with
EPERM on this WSL /mnt DrvFs mount; git rename-detection pairs the
identical-content files at commit time.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/document-navigator/docs/api-stack/api/api-sandbox-wasm/src/policy/policy.md

@@ -0,0 +1,76 @@
+# policy
+
+<!-- begin:auto-docs -->
+_(no submodules)_
+<!-- end:auto-docs -->
+
+## Purpose
+
+Defines the `PermissionPolicy` value object and the
+`resolvePermissionPolicy` builder that lifts a `PermissionsManifest`
+into the structurally-typed object the WASM sandbox host consumes.
+Keeping the policy shape in this package — rather than importing it
+from `@suaveplan/api-sandbox-permissions` — lets the WASM host ship
+ahead of the in-flight permissions package without sacrificing
+strict typing of the gating surface.
+
+The shape is intentionally structural so the eventual permissions
+package can hand a compatible object without taking a hard runtime
+dependency on this package's binding.
+
+## Features
+
+- Zod-validated normalisation: empty manifest, missing fields, and
+  malformed budgets all surface as a `ZodError` at the boundary.
+- Deep freezing: every nested collection is `Object.freeze`d so a
+  consumer cannot mutate the resolved policy.
+- `isPermissionPolicy` type guard for adapters that accept either a
+  raw manifest (re-resolved internally) or a pre-resolved policy.
+- `rw:` prefix preserved verbatim — the preopens builder consumes it.
+
+## Usage: Basic
+
+```ts
+import { resolvePermissionPolicy } from "@suaveplan/api-sandbox-wasm/policy";
+
+const policy = resolvePermissionPolicy({
+    fs: ["./uploads/*"],
+    fetch: ["api.stripe.com"],
+});
+```
+
+## Usage: Advanced
+
+```ts
+import {
+    isPermissionPolicy,
+    resolvePermissionPolicy,
+} from "@suaveplan/api-sandbox-wasm/policy";
+
+function ensurePolicy(input: unknown): PermissionPolicy {
+    if (isPermissionPolicy(input)) return input;
+    return resolvePermissionPolicy(input as PermissionsManifest);
+}
+```
+
+## API Reference
+
+- `resolvePermissionPolicy(manifest | undefined): PermissionPolicy`
+- `isPermissionPolicy(value): value is PermissionPolicy`
+- `PermissionPolicy` — `{ fs, fetch, budgets }` frozen value object.
+
+## Implementation Notes
+
+`PermissionsManifest` lives in `@suaveplan/api-types/manifest`. The
+Zod schema is intentionally narrow — only the slots the WASM sandbox
+host cares about. Budget enforcement is delegated to a future
+`BudgetTracker` once `api-sandbox-permissions` ships; this package
+records the values but does not enforce them.
+
+The structural-typing strategy was chosen after weighing alternatives:
+a direct import of `api-sandbox-permissions` would have forced a hard
+ordering of Stage-8 shipments, and a typed-only import would have
+required a `tsconfig` paths trick that the build system does not
+support. The duck-typed `PermissionPolicy` shape avoids both pitfalls
+while keeping the consumer surface narrow enough that a structural
+mismatch is caught by tests.