Commits on May 7, 2026 permissions: decision simulator for "Why?" / "What if?" introspection The simulator replays past decisions or runs hypothetical decisions through the engine *without side effects*: never writes to storage, never updates the watchdog, never appends to the audit log. The sidebar exposes this as the "What if?" tool; policy-author tests use it as a unit-test harness. Adds: - extension/src/policy/simulator.ts: * simulate(input) runs a fresh hypothetical request. Accepts rulesOverride, originGrantOverride, watchdogOverride, and inputLabels. Restores the engine's resolvers in `finally` so simulation is hermetic. * replay(recordId, modifications) takes an audit record id and replays it under modified context. Returns the decision plus a SimulationDiff describing what changed (effect, tier, source, rule, labels added/removed). * recordCurrentResolvers() captures the live resolvers at startup so the simulator can restore them between runs.…