Determine whether load_policies should remain supported #539

Description

PR #538 removes the bundled authz.policy file and makes load_policies a no-op when no policy file is provided, while an explicit --policy-file-path can still load custom p policies and g role assignments.

We need to confirm whether that custom-file workflow is still supported and used before deciding whether to remove the command. Issue #306 says that reading an operator-provided policy file was supported by design and proposes validating or restricting the path, but it does not confirm whether current deployments rely on it.

Tutor still calls load_policies without a file during LMS and CMS initialization. Open PR overhangio/tutor#1496 adds load_authz_schema, while overhangio/tutor#1509 removes the old call. This removes the known no-argument usage once the Tutor change is released, but does not answer whether explicit custom policy files should remain supported.

Questions

• Do any supported deployment integrations call load_policies with --policy-file-path?
• Do operators use custom policy files for policies or role assignments that cannot be represented in the authorization schema or managed through the API?
• If the workflow remains supported, which policy types should the command accept and should the path handling proposed in Bug: load_policies management command path handling #306 be implemented?
• If the workflow is no longer supported, when can the command and its file-migration utility be removed safely?

Done when

• Known integrations and documentation have been checked for explicit custom policy files.
• We have decided whether the custom-file workflow remains supported.
• If it remains supported, the expected policy types, path validation, documentation, and tests are defined.
• If it is removed, the required Tutor release and deprecation path are identified, and Bug: load_policies management command path handling #306 can be closed with the reason.