Fail closed when project policy package.json cannot be read or parsed

[LadyBluenotes]

Problem

Policy reads collapse every package.json read/parse failure into an absent configuration. Absent-policy migration mode permits every discovered source, so a broken manifest can silently broaden permissions.

Evidence

A fixture with 100 installed skill packages and intent.skills: [] exposes zero skills. Replacing the root manifest with malformed JSON makes listIntentSkills() expose all 100, accompanied by a parse warning and the absent-policy migration notice. The same permissive read helper is used for inherited exclusions.

Sources: policy manifest reader, policy resolution.

Verified against main at 206e987 (@tanstack/intent 0.3.8), Node v24.12.0 on macOS arm64. Tests used installed dependencies and synthetic local fixtures.

Acceptance criteria

• Malformed policy-owner JSON prevents policy-controlled listing and loading from returning skills.
• Non-missing filesystem read errors fail with a diagnostic identifying the affected manifest.
• A present non-object manifest is rejected rather than interpreted as absent policy.
• A malformed inherited manifest within a resolved workspace cannot silently remove inherited exclusions or fall back to a broader permission.
• Genuinely missing manifests/keys retain documented absent-policy and inheritance behavior.
• CLI failure returns a nonzero exit code without emitting skill content or writing generated guidance.
• Regression tests fail on the old implementation and cover the core API and relevant CLI paths.

Scope and priority

Priority: High. Type: bug.

Recommended before v0.4.0, in a separate patch-sized PR. Preserve current selector/exclusion semantics and the documented missing-policy migration mode. No new policy storage, content locks, dependencies, or interactive UI changes.

Workspace-boundary discovery is tracked separately in #240: malformed npm root JSON can prevent the workspace itself from being identified. This issue is limited to confirmed project policy files and inherited policy within a resolved workspace.