fix(webui): tighten PR #856 remediation docs and nav assertions (#646)

Clarify that Policy is live (not a Phase 1 placeholder) in shell docs and
nav module docstring. Strengthen the Policy nav graduation test to assert
status=live and absence of the nav-stub CSS class.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/webui-local-dev.md

@@ -258,7 +258,7 @@ The view never edits policy and exposes no gate-weakening toggle.
 The console shell (`webui/layout.py`) renders a grouped navigation driven by a
 single nav-config module, `webui/nav.py`. Nav groups follow the epic #631
 Phase 1 information architecture: **Health, Traffic, Runtime/Sessions,
-Projects, Inventory, Timeline, Policy, and Insights**
+Projects, Inventory, Timeline, Policy** (live via #646), and **Insights**
 (placeholder). Live views and Phase 1 placeholders (`stub`) are declared in one
 place so the layout and the route table cannot drift.
 
@@ -268,10 +268,10 @@ a **mode: read-only** badge — plus a **Docs** link to this document. No
 privileged action controls are present in the Phase 1 shell.
 
 Not-yet-implemented surfaces (`/sessions`, `/inventory`, `/timeline`,
-`/insights`) resolve to graceful read-only stub pages instead of
-404s; their backing views land in later child issues of #631 (the inventory
-surfaces are backed by #636). Mutating methods on stub routes still fail closed
-with `read-only-mvp`.
+`/insights`) resolve to graceful read-only stub pages instead of 404s; their
+backing views land in later child issues of #631 (the inventory surfaces are
+backed by #636). `/policy` is a live read-only surface (#646), not a stub.
+Mutating methods on stub routes still fail closed with `read-only-mvp`.
 
 ## System-health dashboard (#639)