chore: rename packages/ to crates/

Move all 29 workspace members from packages/<name>/ to crates/<name>/.
Updates: workspace Cargo.toml (members + path deps), justfile, root
CLAUDE.md, scripts/build/CARGO_INSTALL.md, docs/architecture/crates.md
(renamed from packages.md), structural references in docs/architecture
and docs/configuration, per-crate CLAUDE.md self-references. Historical
plans, reports, and building/ docs are left untouched.

No behavior change; just check-all stays green and fermata tests pass.

tests/core_policy_command.rs

@@ -0,0 +1,52 @@
+use dirigent_fermata::core::{Decision, Policy};
+use std::fs;
+use tempfile::TempDir;
+
+fn project_with(toml: &str) -> TempDir {
+    let tmp = TempDir::new().unwrap();
+    fs::write(tmp.path().join("botignore.toml"), toml).unwrap();
+    tmp
+}
+
+#[test]
+fn deny_substring_blocks() {
+    let tmp = project_with("[bash]\ndeny = [\"rm -rf /\"]\n");
+    let p = Policy::load(tmp.path()).unwrap();
+    assert!(matches!(p.check_command("sudo rm -rf / now").unwrap(), Decision::Deny(_)));
+}
+
+#[test]
+fn deny_glob_blocks() {
+    let tmp = project_with("[bash]\ndeny = [\"git push --force*\"]\n");
+    let p = Policy::load(tmp.path()).unwrap();
+    assert!(matches!(p.check_command("git push --force-with-lease").unwrap(), Decision::Deny(_)));
+}
+
+#[test]
+fn ask_returns_ask() {
+    let tmp = project_with("[bash]\nask = [\"rm *\"]\n");
+    let p = Policy::load(tmp.path()).unwrap();
+    assert!(matches!(p.check_command("rm somefile").unwrap(), Decision::Ask(_)));
+}
+
+#[test]
+fn allow_prefixes_allows() {
+    let tmp = project_with("[bash]\nallow_prefixes = [\"make test\"]\n");
+    let p = Policy::load(tmp.path()).unwrap();
+    assert_eq!(p.check_command("make test").unwrap(), Decision::Allow);
+    assert_eq!(p.check_command("make test-unit").unwrap(), Decision::Allow);
+}
+
+#[test]
+fn no_rules_means_allow() {
+    let tmp = project_with("");
+    let p = Policy::load(tmp.path()).unwrap();
+    assert_eq!(p.check_command("anything goes").unwrap(), Decision::Allow);
+}
+
+#[test]
+fn deny_takes_precedence_over_allow_prefix() {
+    let tmp = project_with("[bash]\ndeny = [\"rm -rf /\"]\nallow_prefixes = [\"rm\"]\n");
+    let p = Policy::load(tmp.path()).unwrap();
+    assert!(matches!(p.check_command("rm -rf /").unwrap(), Decision::Deny(_)));
+}