feat(P03 W4): pilot-readiness + settlement-finality kyverno-json policies (REQ-315, REQ-320)

REQ-320: policies/pilot-readiness/no-placeholder-account.json asserts
account_id != "000000000000" over the env JSON (critical severity — a
placeholder account drives a block band). Passes on dev (581513795199),
fails on placeholder. REQ-315: policies/settlement-finality/all-matches-
committed.json asserts all_committed == true over the settlement status
JSON (critical severity). Authored + tested in v1.26; enforcement gates
qa/prod/dr promotions, not dev (G-Q6 — dev all_committed is vacuously
true). Both policy tests run against real kj (not skipped).

---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W4
---

tests/fixtures/pilot_readiness/placeholder_account.json

@@ -0,0 +1,4 @@
+{
+  "account_id": "000000000000",
+  "region": "us-east-1"
+}

tests/fixtures/pilot_readiness/real_account.json

@@ -0,0 +1,7 @@
+{
+  "account_id": "581513795199",
+  "region": "us-east-1",
+  "state_backend": {
+    "bucket": "nova-tfstate-dev"
+  }
+}

tests/fixtures/settlement_finality/all_committed.json

@@ -0,0 +1,6 @@
+{
+  "contract_id": "blkex",
+  "environment": "dev",
+  "all_committed": true,
+  "matches": []
+}

tests/fixtures/settlement_finality/uncommitted.json

@@ -0,0 +1,13 @@
+{
+  "contract_id": "blkex",
+  "environment": "dev",
+  "all_committed": false,
+  "matches": [
+    {
+      "txn_id": "t1",
+      "symbol": "AAPL",
+      "finalized": false,
+      "block_index": 1
+    }
+  ]
+}