Add BoundaryPolicy to authority spec with cross-field validation

[aidankhogg]

Motivation

• Introduce an authority-layer boundary policy to represent real-internet and cross-world posture and trust requirements for the gateway/boundary domain.
• Capture required configuration surface (service mirrors, upstream resolver, peers) and enforce cross-field invariants that previously lived only in procedural checks.

Description

• Add BoundaryPolicy Pydantic model to netengine/spec/authority.py with fields real_internet, cross_world, service_mirrors, upstream_resolver_enabled, upstream_resolver_ip, and peers, and a @model_validator(mode="after") implementing the requested validation rules.
• Implement validations that require mirrors for MIRRORED, forbid mirrors unless mode is MIRRORED, require peers for PEERED/FEDERATED, require trust metadata (trust_bundle or trust_anchor_cert) for FEDERATED peers, and disallow upstream resolution when ISOLATED.
• Add trust_bundle: Optional[str] to CrossWorldPeer in netengine/spec/models.py and export BoundaryPolicy from netengine/spec/__init__.py.
• Add unit tests in tests/test_authority_spec.py covering defaults and each validation path and update imports accordingly.

Testing

• Ran pytest tests/test_authority_spec.py tests/test_gateway_federation.py tests/test_gateway_portal.py tests/test_spec_parsing.py and all tests passed (83 passed, 8 warnings).
• Ran style/lint checks with poetry run ruff check netengine/spec/authority.py netengine/spec/models.py netengine/spec/__init__.py tests/test_authority_spec.py and all checks passed.

---

Codex Task