Right-size, what-if, and replay for policies

Writing a policy from scratch means guessing which tables an agent needs. Guess too wide and the policy does nothing. Guess too narrow and you spend a week loosening it one column at a time. Your audit log already knows the answer, so PgBeam now reads it for you.

• Right-size: generates a least-privilege policy from the traffic a credential actually ran. Tables, columns, and statement types come from observed queries, not from a blank form.
• What-if: evaluates a draft policy in the editor and shows which of your recorded statements it would allow, mask, or refuse, before the policy is live.
• Replay: runs recorded agent traffic against a candidate policy and reports every difference against the policy in force. This is how you tighten a policy on a working agent without discovering the breakage in production.

All three are reachable from the policy list in the dashboard and from the API. There is also a new pgbeam policies lint command that flags risky rules (over-broad allowlists, missing row caps, write access nobody asked for) so you can run the check in CI instead of remembering to look.