refactor(plugin): port security policy resolution to TypeScript (#799)

* Port security policy helper with native path support

* fix(plugin): preserve Windows policy path components

* test(plugin): make policy fixtures portable across hosts

* fix(plugin): clarify policy helper compatibility and invocation

* test(native): record platform-specific file-parent resolution

* Preserve policy helper malformed help errors

* test(plugin): remove completed runtime characterization

* fix(plugin): resolve Windows policy ancestry by directory identity