fix(sdk): wrap tool-policy writes in a transaction

[ra-co88]

What

Tool-policy creates and updates wrap their read-decide-write (position computation, existence check, then write) in a single transaction.

Why

The read and the write ran as unsequenced statements — concurrent policy edits could interleave and silently overwrite each other (lost updates). The credential and integration upserts already use the transaction wrapper; policy writes now share that discipline.

What changed

Both paths compose inside one transaction (real BEGIN/COMMIT on libSQL/Postgres). Validation stays outside the transaction; the returned row is always the committed post-write row.

Test plan

Round-trip, missing-policy failure, boundary read, and an interleaved-update no-lost-update proof. 4 tests green against current main.

[ra-co88]

Heads-up on the red E2E (cloud 13of16) check here: it's failing on main itself (e.g. the Version Packages runs), so it's pre-existing rather than from this PR. It's the cap-eviction scenario tripping over workerd resetting session Durable Objects mid-initialize when the test opens its burst of sessions — diagnosis and a proposed fix in #1895.