fix(core): restore Console policy precedence over MDM - #59641

Summary

• Restore policy authority to Console → macOS managed preferences → system → user/project.
• Keep the current integration-document pipeline: load integration documents before the managed policy documents.
• Cover conflicting allows/denies, managed-policy fallback, and disconnect; update the precedence documentation.

This changes policy precedence. Ordinary settings continue to use their existing merge order.

Verification

• 112 tests pass across config, policy, and Console-provider suites.
• Full bun run check passes with pinned Bun 1.4.4 (existing lint warnings).
• Website typecheck and production build pass.
• Automated cross-model review unavailable: required reviewer CLI is not installed.

Before / after proof

Ran the same Config service integration request against base 115113931c in a separate checkout and this branch, using temporary configuration directories and the real config loader and policy evaluator.

Managed system file: deny shell:rm*, allow shell:ls, deny shell:git*.
Console integration document: allow shell:rm*, deny shell:ls.
Then remove the integration document and evaluate again. These are policy evaluations; no shell commands are executed.

Before:

{
  "connected": {
    "shell:rm -rf": "deny",
    "shell:ls": "allow",
    "shell:git push": "deny"
  },
  "disconnected": {
    "shell:rm -rf": "deny"
  }
}

After:

{
  "connected": {
    "shell:rm -rf": "allow",
    "shell:ls": "deny",
    "shell:git push": "deny"
  },
  "disconnected": {
    "shell:rm -rf": "deny"
  }
}

Test locally

From this branch:

cd packages/core
bun run script/test.ts test/config/config.test.ts --test-name-pattern 'ranks integration policies'

Expected: 1 pass, 0 fail. The test uses temporary files and an injected Console document, so no MDM profile or Console account changes are needed.

Visual

Real TUI recordings with the same prompt and policy conflict on both branches. A temporary managed-system config denies shell:echo console-policy-wins; an injected Console integration document allows it. Both go through the production config loader, policy evaluator, permission hook, and shell tool. The demo uses the managed-system path shared with MDM policy ordering; it does not deploy an MDM profile or change workspace policies.

Before — base 115113931c: managed policy wins and blocks the command.

After — 10786f5624: Console wins and the command prints console-policy-wins.