feat(policies): add attestation phase lifecycle control

[migmartri]

supersedes #2762

Summary

• Add AttestationPhase enum (INIT, PUSH) to the crafting schema proto to control when attestation policies are evaluated
• Add attestation_phases field on PolicySpecV2 so policy authors can restrict evaluation to specific lifecycle phases
• When no phases are specified, the policy runs at all phases (backwards compatible)
• Policy evaluation is decoupled from the attestation status command — status is now a read-only observer that displays existing evaluations from crafting state
• attestation init evaluates policies explicitly at INIT phase, attestation push evaluates at PUSH phase
• Cross-phase results are preserved: PUSH-phase evaluation overwrites INIT results for the same policy, while INIT-only policies are kept intact

Closes #2764

Example

apiVersion: workflowcontract.chainloop.dev/v1
kind: Policy
metadata:
  name: final-approval-check
spec:
  policies:
    - kind: ATTESTATION
      path: approval-check.rego
      attestation_phases:
        - PUSH