Fix command-form approval rules

[16francej]

Fixes #296 by generating approval patterns accepted by the runtime policy matcher and validating layer patterns during load.

• verification: 47 affected tests passed
• verification: typecheck, lint, and formatting passed

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}