Add SetPolicyEngine and GetPolicyEngine scripts for AdvancedPoolHooks ACE integration

[SyedAsadKazmi]

Adds the policy engine surface to the hooks tooling, so an AdvancedPoolHooks contract can be connected to a Chainlink ACE Policy Engine on the same chain, or disconnected, without hand-rolled cast send calls. The detach-revert recovery path is first-class: ALLOW_FAILED_DETACH=true routes the same script to setPolicyEngineAllowFailedDetach.

What's included

• CctActions._setPolicyEngine and CctActions._setPolicyEngineAllowFailedDetach: action-layer builders encoding both hook setters via abi.encodeCall, so the recovery path composes into Safe batches like every other operation
• script/configure/policy-engine/SetPolicyEngine.s.sol: env-driven (POOL_HOOKS, POLICY_ENGINE, ALLOW_FAILED_DETACH), resolves the hooks via the standard ladder, refuses a same-address no-op and a codeless engine address before broadcasting (the hook's attach() would revert with empty data), notes the zero-address disconnect, and prints the make snapshot-chain follow-up (mode-aware: Next: vs After the Safe executes:) because hooks.policyEngine is a governance-critical roles{} field. A parameterized runWith(address,address,bool) entrypoint carries the behavior so tests drive it without process-wide env writes
• script/configure/policy-engine/GetPolicyEngine.s.sol: read-only companion
• test/actions/PolicyEngineActions.t.sol: fork tests for attach/swap/disconnect, the same-address no-op, and builder selector parity
• test/actions/PolicyEngineReviewProofs.t.sol + test/actions/PolicyEngineReviewFixes.t.sol: proofs and fix validations against the REAL ACE 1.0.0 PolicyEngine + VolumePolicy (deployed as clones, not the mock): the roles{} drift after a swap, the codeless-engine empty revert, the unprovisioned-engine PolicyRunRejected, the detach-revert block and its TargetAlreadyAttached follow-on, the provision-then-swap order, and the postflightCheck gas measurement (one VolumePolicy alone runs ~97k gas against the 90k destGasOverhead default)
• test/governance/SafeMode.t.sol: both builders in the byte-equality catalog, plus an end-to-end Mode B test (hooks owned by a 2-of-3 Safe take setPolicyEngine through execTransaction; the former EOA owner is refused)
• @openzeppelin/contracts-upgradeable@5.0.2 as a direct dependency: ACE 1.0.0's Policy.sol calls the 5.x __Ownable_init(initialOwner), and the transitively hoisted 4.9.6 broke compilation of the real engine
• script/docs/gen-primitives.mjs: policy-engine group mapping; regenerated docs/primitives/ catalog, index, and pages with authored _meta.json context (destructive: true, provisioning and destGasOverhead preconditions, the re-snapshot postcondition, and the failure modes including TokenHandlingError(token, 0x))
• docs/operations/policy-engine.md: banner names make snapshot-chain, a "Before you set an engine" section covers provisioning, destGasOverhead and the ACE 1.0.0 vs 1.1.1 TargetNotAttached difference, MODE=safe for Safe-owned hooks, the two pre-broadcast refusals, and ALLOW_FAILED_DETACH; linked from hooks-allowlist.md, the README production-operations list, and the guides index

[github-actions]

👋 SyedAsadKazmi, thanks for creating this pull request!

To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team.

Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks!