feat(app): wire sysadmin author-only policy into projectinstance

Adapt sysadmin.AuthorOnlyPolicySource at the composition root so
projectinstance stays within module-boundary allowlists.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/app/app.go

@@ -220,6 +220,9 @@ func Assemble(cfg *config.Config, svc *bizdev.Service) (*Runtime, error) {
 		},
 		FeatureValues: sysadminFeatureValues(cfg),
 	})
+	if instSvc != nil {
+		instSvc.SetAuthorOnlyPolicySource(&sysadminAuthorOnlyPolicyAdapter{svc: rt.SysAdmin})
+	}
 	rt.DocNotify = &docnotify.Subscriber{Notify: rt.Notify, Docs: parts.Gov}
 	rt.DocNotify.SkipWrite = func(ctx context.Context) bool {
 		return rt.WriterLive(ctx, events.ConsumerNotify)

internal/app/author_only_policy_adapter.go

@@ -0,0 +1,38 @@
+package app
+
+import (
+	"context"
+
+	"chat-agent-system/internal/projectinstance"
+	"chat-agent-system/internal/sysadmin"
+
+	"github.com/jackc/pgx/v5"
+)
+
+// sysadminAuthorOnlyPolicyAdapter 将 sysadmin.AuthorOnlyPolicySource 适配为
+// projectinstance 本地窄接口，避免 projectinstance 反向依赖 sysadmin。
+type sysadminAuthorOnlyPolicyAdapter struct {
+	svc *sysadmin.Service
+}
+
+func (a *sysadminAuthorOnlyPolicyAdapter) GetAuthorOnlyApprovalPolicy(ctx context.Context) (projectinstance.AuthorOnlyPolicySnapshot, error) {
+	if a == nil || a.svc == nil {
+		return projectinstance.AuthorOnlyPolicySnapshot{}, sysadmin.ErrStoreUnavailable
+	}
+	pol, err := a.svc.GetAuthorOnlyApprovalPolicy(ctx)
+	if err != nil {
+		return projectinstance.AuthorOnlyPolicySnapshot{}, err
+	}
+	return projectinstance.AuthorOnlyPolicySnapshot{Allowed: pol.Allowed, Revision: pol.Revision}, nil
+}
+
+func (a *sysadminAuthorOnlyPolicyAdapter) LockAuthorOnlyApprovalPolicy(ctx context.Context, tx pgx.Tx) (projectinstance.AuthorOnlyPolicySnapshot, error) {
+	if a == nil || a.svc == nil {
+		return projectinstance.AuthorOnlyPolicySnapshot{}, sysadmin.ErrStoreUnavailable
+	}
+	pol, err := a.svc.LockAuthorOnlyApprovalPolicy(ctx, tx)
+	if err != nil {
+		return projectinstance.AuthorOnlyPolicySnapshot{}, err
+	}
+	return projectinstance.AuthorOnlyPolicySnapshot{Allowed: pol.Allowed, Revision: pol.Revision}, nil
+}