Control async side effects with versioned policy snapshots
General lesson: asynchronous side-effect controls are reliable only when authorization is modeled as a versioned policy snapshot, not as a boolean checked once. This applies to queued or long-running work governed by a global kill switch plus per-route, per-tenant, or per-featur…