[drknowhow]

Cuts a release for #178 so the feature can actually reach the box.

Why a release is needed at all

The hub imports from site-packages, not the checkout — ~/.c3/hub_start.py
sets _REPO to the site-packages path — so a merge to main is invisible to
the running process, and a restart alone re-imports the same tree.

Verified rather than assumed:

running hub:  pythonw ~/.c3/hub_start.py
_REPO      -> the site-packages directory, not the checkout
cli.hub_server resolves there; that cli/ is a real copy, not a symlink
GET /api/hub/overrides/policy on :3330  ->  405

The 405 is the tell: it fell through to the POST-only <request_id> route,
which is exactly what "this route does not exist in this process" looks like.
c3 upgrade installs from PyPI, so it cannot see unreleased main either.

Path to live is merge → release → reinstall → restart → probe. This is step
two.

Contents

Only #178: the hub Access screen's "May agents ask?" panel,
GET/POST /api/hub/overrides/policy, and the extraction of
validation / widening / write into services/override_policy so the hub and
the phone share one implementation.

Verification

• Both version sites bumped in one pass. test_version_sync exists because
  v2.56.0 shipped with pyproject.toml and cli/c3.py disagreeing — it passes
  here, and it was run after the changelog edit, since the last edit and the
  last verification have to be the same tree.
• 811 passed across the areas this release touches.
• The single failure,
  test_mobile_clients::TestClientAuth::test_chat_poll_shares_the_credential_set
  (404 != 401), is pre-existing test-ordering pollution: it passes in
  isolation and by file, and fails identically on clean main with the same
  -k. Proven before this branch existed, not asserted.

After merge

Tag v2.129.2, then watch the release run to green before any further push
to main. A push between the tag and the gate cancels the tagged CI run and the
release silently skips PyPI — that is what happened on v2.119.0. Then reinstall,
restart the hub, and probe /api/hub/overrides/policy for a 200.