fix(policy): preserve immutable validation precedence #2381

Job	Run time
Resolve PR metadata	6s
build-supervisor / Resolve build plan	2s
build-gateway / Resolve build plan	3s
build-cli / Resolve build plan	3s
build-cli / Rust cli (amd64) / cli (amd64)	4m 44s
build-supervisor / Rust sandbox (arm64) / sandbox (arm64)	3m 44s
build-supervisor / Rust sandbox (amd64) / sandbox (amd64)	3m 37s
build-gateway / Rust gateway (arm64) / gateway (arm64)	6m 52s
build-gateway / Rust gateway (amd64) / gateway (amd64)	6m 32s
build-supervisor / Build supervisor (amd64)	1m 21s
build-supervisor / Build supervisor (arm64)	1m 20s
build-cli / Merge ${{ inputs.component }} manifest	0s
build-cli / Build ${{ inputs.component }} (${{ matrix.arch }})	-1s
build-supervisor / Merge supervisor manifest	1m 1s
build-gateway / Build gateway (arm64)	1m 27s
build-gateway / Build gateway (amd64)	1m 27s
gpu-e2e	0s
GPU E2E result	0s
build-gateway / Merge gateway manifest	1m 5s
e2e / E2E (mcp)	6m 51s
e2e / E2E (rust-podman-rootless, ubuntu-26.04)	19m 19s
e2e / E2E (rust-docker)	8m 10s
kubernetes-e2e (v1beta1, v0.5.0) / Kubernetes E2E (Rust smoke, Agent Sandbox v1beta1)	9m 31s
kubernetes-e2e (v1alpha1, v0.4.6) / Kubernetes E2E (Rust smoke, Agent Sandbox v1alpha1)	9m 41s
e2e / E2E (python)	6m 54s
e2e / E2E (rust-podman-rootless, ubuntu-24.04)	17m 48s
kubernetes-ha-e2e	0s
Kubernetes HA E2E result	-1s
Core E2E result	3s
	1h 51m 39s

Provide feedback