Eleventh PR in the 12-PR file-policy rollout. Promotes five of the
seven advisory checks to --mode blocking-allowlist in CI:

  check-file-policy
  check-generated
  check-executable-files
  check-dependency-surfaces
  check-workflow-surfaces

check-process-policy and check-network-policy stay at --mode advisory
until PR 12 (#211).

## What this PR actually does

Promoting check-file-policy from advisory to blocking surfaced two
real problems with the prior architecture:

1. **Double counting.** The non-Rust-allowlist checker only consulted
   `policy/non-rust-allowlist.toml`. Files already receipted in
   companion ledgers (`generated`, `executable`,
   `dependency-surface`, `workflow`) were reported as unreceipted by
   this checker — 945 false unreceipted entries, dominated by the 813
   `**/*.snap` files in the generated ledger.

2. **Missing receipts for the actually-uncovered ~107.** PR 2's
   seeded receipts covered top-level docs, agent files, license,
   release artifacts, build config, and four broad subtree globs.
   Repo-internal dotfile dirs (`.cargo/`, `.config/`, `.factory/`,
   selected `.github/` files), per-crate agent docs, per-crate
   READMEs, proptest regression seeds, the policy ledgers themselves,
   and `xtask/Cargo.toml` were all uncovered.

This PR resolves both:

### Refactor: companion-ledger pre-filter

`xtask/src/check_file_policy.rs` now loads the other four ledgers
(`generated-allowlist.toml`, `executable-allowlist.toml`,
`dependency-surface-allowlist.toml`, `workflow-allowlist.toml`),
builds a `CompanionSelector` set, and excludes any tracked file
matched by any companion selector before reconciliation. The non-Rust
checker now sees ONLY files that aren't receipted elsewhere.

Universe drops from 1018 → 178 (the 813 + 9 + ~16 + others handled by
companions).

### Receipts: cover the remaining 107

Adds broad-glob receipts for:

  .cargo/**          .config/**        .factory/**
  .github/CODEOWNERS .github/copilot-instructions.md .github/settings.yml
  .gitignore         crates/**/AGENTS.md   crates/**/CLAUDE.md
  crates/*/README.md crates/*/proptest-regressions/**
  policy/**

And adds `xtask/Cargo.toml` to `dependency-surface-allowlist.toml`
(where it belongs — it's a dep manifest).

Removed the `fuzz/**` glob from non-rust-allowlist (it was unused
after the companion-ledger filter — fuzz tracked files are now all
covered by `.rs` exclusion or `fuzz/Cargo.toml` in dep-surface).

### CI: promote five checks

`.github/workflows/ci.yml` `policy` job (was `Policy (advisory)`,
renamed to `Policy`) now runs the five blocking checks plus the two
advisory checks plus `cargo xtask policy-report`. The unified report
step uses `if: always()` so the artifact lands even when one of the
blocking checks fails. Upload still uses
`actions/upload-artifact@v7` and `if-no-files-found: error`.

### Docs

- `docs/FILE_POLICY.md` "Rollout" section marks PR 11 as the
  *current state of the rollout* and explains the rename.
- `docs/POLICY_ALLOWLISTS.md` and `docs/policy/NON_RUST_ROLLOUT.md`
  flip PR 10 to "landed" and PR 11 to "in flight".

## Acceptance (local)

  cargo xtask check-file-policy --mode blocking-allowlist
    file-policy (blocking-allowlist): tracked=178 entries=35
    unreceipted=0 missing_fields=0 expired=0 stale=0 unused=0

  cargo xtask check-generated --mode blocking-allowlist            (clean)
  cargo xtask check-executable-files --mode blocking-allowlist     (clean)
  cargo xtask check-dependency-surfaces --mode blocking-allowlist  (clean)
  cargo xtask check-workflow-surfaces --mode blocking-allowlist    (clean)

  cargo check --workspace --locked   OK
  cargo clippy -p xtask --all-targets --locked -- -D warnings  clean
  cargo fmt --all -- --check  clean

## Out of scope

- PR 12 (#211): promote check-process-policy and check-network-policy
  to blocking-allowlist after a clean observational window.
- blocking-strict mode (which fails on unused entries and stale
  review dates) remains deferred to a future cleanup pass.

Closes #210.