CHW-2306 PublishPolicyBlocked

Policy Enforcement

publish blocked by policy; the rule that fired is named in the response payload's policy_id / rule_id field

Default message: publish blocked by policy; the rule that fired is named in the response payload’s policy_id / rule_id field
HTTP status: 403 (client)
Reason: POLICY_BLOCK

Problem. A PUT/POST upload to a hosted repository returned 403. Cause. The policy engine evaluating input.surface == "publish" returned block. The matching rule id (or native policy id) and violation reason are in the response payload’s policy_id / rule_id and reason fields. Fix. Either ship a version that satisfies the rule, or ask an operator to amend the policy. The publish hook fail-opens on engine errors, so this code only fires on a deliberate block decision — not a buggy custom rule. HTTP 403.