Addresses #4421 (policy.rs): extract SnapshotIntegrityError into a submodule

[psaab]

What

Bounded, pure code-motion first increment for the #4421 policy.rs
modularity backlog. Relocates the SnapshotIntegrityError enum plus its
Display and Error impls (~888 LOC — the #1606 snapshot integrity error
group) out of the 4483-LOC userspace-dp/src/policy.rs into a new
#[path]-included sibling submodule userspace-dp/src/policy_snapshot_error.rs.

policy.rs: 4483 → 3598 LOC.

Why this unit

The enum group is fully self-contained:

• variants use only primitive / prelude types (String, i32, u16, u32, u8);
• the Display impl is entirely write!(f, …) over Self:: variants;
• the Error impl is empty.

So the new file needs no imports. It is re-exported with
pub(crate) use snapshot_error::SnapshotIntegrityError; so all ~20 crate-wide
call sites keep the existing crate::policy::SnapshotIntegrityError path, and
policy_tests.rs (attached via use super::*) is unchanged. This mirrors the
#[path = "policy_tests.rs"] idiom already used in the same file.

Pure code-motion proof

• Moved block is byte-identical to master policy.rs lines 14–901 (empty diff).
• policy.rs retained content is byte-identical (empty diff), only a 3-line
  #[path]/mod/use stub inserted.
• Moved block deliberately not rustfmt'd — kept byte-identical to preserve the
  code-motion guarantee; only the stub + //! module-doc lines are new.

Validation

• cargo build green.
• cargo test — 3738 passed (245 policy tests + all 5 snapshot-integrity-error
  tests green). The single native_gre_decap_checksum_present_yields_inner_packet
  failure in the parallel run is a pre-existing shared-counter test-isolation
  flake — it touches no SnapshotIntegrityError code and passes in isolation.

Docs

README source-map table row for policy.rs unchanged: it lists top-level feature
modules, not their #[path] submodules (policy_tests.rs is likewise omitted),
and the module contract is unchanged. _Log.md updated.

Scope

The deeper policy.rs decomposition (parse / evaluate / applications splits) is a
function-restructuring task that needs /triple-review; this PR ships only the
clean, self-contained down-payment.

🤖 Generated with Claude Code

https://claude.ai/code/session_015oARShYtiJJ2H4UB4nXGqi

[Copilot]

Pull request overview

This PR is a focused modularity/code-organization change in the Rust userspace dataplane: it extracts the large SnapshotIntegrityError enum (and its Display/Error impls) out of the monolithic userspace-dp/src/policy.rs into a sibling submodule, while preserving the existing crate::policy::SnapshotIntegrityError access path via a re-export.

Changes:

• Moved SnapshotIntegrityError (+ Display/Error impls) into userspace-dp/src/policy_snapshot_error.rs and wired it in via #[path] mod snapshot_error;.
• Re-exported the type from policy.rs (pub(crate) use snapshot_error::SnapshotIntegrityError;) to keep all existing call sites unchanged.
• Added a corresponding _Log.md entry documenting the write action and touched files.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
userspace-dp/src/policy.rs	Replaces the in-file enum/impl block with a #[path] submodule include and re-export to keep the public-in-crate path stable.
userspace-dp/src/policy_snapshot_error.rs	New submodule containing the extracted SnapshotIntegrityError definition and impls (verbatim code-motion plus new module docs).
_Log.md	Records the extraction action per repository logging practice.