Validate a policy against the redaction policy schema when it is loaded

[jzonthemtn]

Policy.from_dict accepts any dict, and nothing validates it against the schema phisql ships (jsonschema is a dev-only dependency). A policy with an unknown or misspelled key loads and silently stops redacting.

Acceptance Criteria

• Loading a policy validates it against the packaged schema and reports failures.
• Validation is opt-out for callers loading a policy written for an older schema version.
• A test asserts a policy with an unknown key is reported rather than silently accepted.

[jzonthemtn]

Closes a gap against the PhiSQL specification. No RFC: this is the "Phileas degrades silently, not loudly" risk called out in the philterd/phisql 1.3.0 release notes, which is what makes every other gap in this set fail quietly.