Define partial policy matching semantics

[rlippmann]

Explore whether Context Compiler should support explicit partial matching for policy identities.

Questions to resolve:

• Should partial matching be opt-in per directive or policy rather than part of default identity semantics?
• What matching rule is intended: token containment, prefix matching, substring matching, or another deterministic rule?
• How should partial matches interact with use, prohibit, remove policy, and replacement?
• What happens when more than one existing policy matches?
• Should exact matches always take precedence over partial matches?
• How should partial-match behavior interact with normalization and case sensitivity?

The current default should remain exact canonical policy identity matching unless this feature is explicitly defined.