Add dev namespace access and kubectl to POLICIES.md and TOOLS.md

Each org now has a -dev namespace where agents can freely use kubectl
for testing and iteration. Production namespaces remain Flux-only.

Access model:
- Cluster-wide: read-only
- Production namespace: read-write (Flux-managed, no manual kubectl)
- Dev namespace: read-write (agents may use kubectl freely)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

TOOLS.md

@@ -25,6 +25,7 @@ Auto-injected env vars:
 | `node` / `npm` / `pnpm` / `npx` | Node.js runtime and package management |
 | `python3` | Python scripting |
 | `pnpm paperclipai` | Paperclip CLI — issue/agent operations |
+| `kubectl` | Kubernetes CLI — read-only cluster-wide, read-write in `privilegedescalation` and `privilegedescalation-dev` |
 
 ## Repos