examples: second policy.yaml for email recipient domain confirm

[CodewithJha]

👋 New to open source?
Thanks for considering contributing to Mutiny.
This issue is intentionally beginner-friendly.
If you get stuck, ask questions in the comments.
We're happy to help.

Context

Sample agent tools include email (send_email is denied in the support sample). Extra policy packs under examples/policies/ help contributors learn operators without touching Core. Today that folder has harness JSON (e.g. demo_support.json), not a YAML pack teaching recipient-domain confirmation.

Goal

Add an example policy teaching “recipient domain must be confirmed” (or similar) using mock tools only, plus a short README blurb.

Why it matters

A second pack shows how to express domain / confirmation invariants beyond the refund/delete sample — good practice for adapter authors.

Acceptance criteria

• Add an example policy for email / recipient-domain style invariants (YAML preferred under examples/policies/, or documented sibling)
• Short README explaining intent and that tools are mocks / authorized testing only
• Valid YAML (or documented JSON if matching existing harness format); no Core evaluator changes
• PR description links this issue

Suggested files

• examples/policies/ (new policy file + README section or examples/policies/README.md)
• Optional cross-link from examples/openai_support_agent/README.md
• Do not change Core evaluator semantics

Out of scope

• Real email sending, Core operator changes, Hosted UI for packs

Hints

• Reuse operators already covered in tests/unit/test_policy_evaluator.py (require_args, forbid_args, context constraints).
• Keep tool names obviously fake (send_email, recipient, domain, confirmed).
• One rule + one “bad call” comment in the README is enough.

Difficulty

S · examples only

Docs

• Catalog: GOOD_FIRST_ISSUES.md #27
• Sample: examples/openai_support_agent