feat: add policy-gated auto remediation