List the signed policy bundles issued to the organization

Signs the bundle hosted evaluation would run on right now and returns it as a compact JWS for the Decionis edge evaluator (the WebAssembly policy core a deployment runs inside its own network). The edge evaluator evaluates only bundles Decionis signed: it verifies the signature against the keys its release pins (published at `/.well-known/decionis-policy-bundle-jwks.json`), the audience against its organization, the validity window against the time its host supplies, and the bundle against `bundle_digest`. Selection is hosted evaluation's own: the newest active bundle whose effective window contains now and that passes the maker-checker gate, or, when `policy_version` is given, exactly that version among them. An unapproved, historical, not-yet-effective or expired bundle is never signed; like hosted evaluation, it is treated as not active and the answer is `404 POLICY_BUNDLE_NOT_FOUND` with the policy guard's reason. The signed bundle lives `ttl_seconds` (default 7 days, at most 30 days and at most the organization's plan maximum), never past the bundle's own `effective_to`. Every issuance is recorded before it is returned (see `GET /v1/edge/policy-bundles/issuances`); one that cannot be recorded is not issued. Requires an organization API key with `policy:read` (or `policy:*` / `org:*`); keys without explicit scopes are refused. Only organizations licensed for the edge evaluator receive bundles: Enterprise and self-managed plans include it, Premium with the edge add-on, and an operator may list an organization for a pilot. Any other organization is answered `403 EDGE_EVALUATOR_NOT_ENTITLED` (its signed entitlement, `GET /v1/edge/entitlement`, says why). The bundle is `core_abi: 3`: it also carries what hosted would decide differently for this organization, resolved with hosted's own code — `vertical_pack` (its configured pack, or the operator's pack override, else null) and `max_mode` / `max_mode_reason` (SHADOW with hosted's 403 code for an unclaimed provisional or AWS service workspace, else ENFORCEMENT). An edge module older than ABI 3 refuses such a bundle rather than decide without them. A bundle whose rules compare two facts (`EQ_FACT`, `NEQ_FACT`) is `core_abi: 7`, which an edge module older than ABI 7 refuses the same way, and one that declares `allowed_transitions` is `core_abi: 8`, which an edge module older than ABI 8 refuses. A bundle with a rule that draws on a held allowance (`then.allowance`) is never signed for an edge: only hosted Decionis holds an allowance, and an edge module would approve such a rule with nothing reserved.