solution: declare & enforce per-method effect/network policy on the Solution contract

[antoinetoussaint-byte]

Follow-up from #287 (see PR #288 review, finding D3).

The Solution proto service (proto/codefly/services/solution/v0/solution.proto) exposes Package (pushes an OCI artifact — network write) and Render (writes into a gitops repo — filesystem/git mutation) with no host-enforceable effect/network declaration, unlike provider.proto which binds a provider_method_policy (network mode + effect ceiling) to every RPC.

We deliberately did not add an enforcement extension in #287 because there is no host-side broker to enforce it yet — an unenforced policy annotation would be decorative (the exact smell finding D2 targeted). This issue tracks doing it for real:

• Define a solution method-policy extension (effect + network ceiling) mirroring provider_method_policy.
• Annotate each RPC (Create/Update/Package/Render) with its true effect.
• Add the host-side enforcement point that reads and enforces the annotation.

Until then the RPC contract documents its side effects only in comments; nothing enforces them.