Merge managed policy over user config with this project's precedence.
The single statement of managed-over-user precedence. It was assembled by hand at three call sites, two carrying "must match" comments, and had already drifted once: the site that omitted the validator reported a user table as effective while its provenance credited managed policy.
Absolute manifest path of the subtree being merged. The union set and the validator both match paths relative to where the merge starts, so a subtree merge needs them rebased: an absolute deny-list path never matches inside a subtree, and an unprefixed leaf path resolves to no manifest option, which makes the validator accept everything.
