Evaluate an install policy decision for a batch of plugin sources

Returns a per-source allow/warn/block decision plus structured reasons. For users who belong to multiple orgs, the lowest-sorted org id wins and a warning is logged — set up an org-scoped API key to avoid the picker's arbitrary choice.