feat(policies): config refinements + new-version output (post-#6598) (#6604)

Follow-up to #6598 (squash-merged into `SaaS`). These are the policy
refinements made after that merge, against the current `SaaS` tip.

## Changes
- **Simplify Security config + plain-language info buttons** — Redact
config reduced to the PII field; Sanitise has no config
(JavaScript-removal only) with a non-technical info button; per-tool
info buttons reworded to match the tool-steps style.
- **Hide 'Flatten PDF pages to images' from the watermark policy
config** — new `PolicyWatermarkConfig` wrapping the watermark settings
with the flatten checkbox gated off.
- **Flatten-to-image on by default for redact + watermark** — both
normalise `convertPDFToImage: true` on mount.
- **Self-heal a stale backing folder** — `ensurePolicyFolder` recreates
a backing folder whose `folderId` no longer resolves (preferring the
backend's stored automation), instead of hanging Edit Settings on a
permanent "Loading…".
- **Version the input file on 'new version' output mode** — completed
runs whose policy output mode is `new_version` replace the input file
with a versioned child (origin tool `automate`) rather than adding a
separate file; falls back to a new file if the input is gone.
`outputMode` is plumbed through `PolicyState`, the local-cache default,
and backend reconciliation.

## Verification
- `typecheck:proprietary` + `typecheck:core` clean
- policy + hooks vitest: 17 passing
- eslint + prettier clean on all changed files

frontend/editor/src/core/components/tools/addWatermark/AddWatermarkSingleStepSettings.tsx

@@ -21,12 +21,15 @@ interface AddWatermarkSingleStepSettingsProps {
     value: AddWatermarkParameters[K],
   ) => void;
   disabled?: boolean;
+  /** When false, hide the "Flatten PDF pages to images" option (e.g. in policies). */
+  showFlatten?: boolean;
 }
 
 const AddWatermarkSingleStepSettings = ({
   parameters,
   onParameterChange,
   disabled = false,
+  showFlatten = true,
 }: AddWatermarkSingleStepSettingsProps) => {
   return (
     <Stack gap="lg">
@@ -69,6 +72,7 @@ const AddWatermarkSingleStepSettings = ({
           parameters={parameters}
           onParameterChange={onParameterChange}
           disabled={disabled}
+          showFlatten={showFlatten}
         />
       )}
     </Stack>

frontend/editor/src/core/components/tools/addWatermark/WatermarkFormatting.tsx

@@ -10,12 +10,15 @@ interface WatermarkFormattingProps {
     value: AddWatermarkParameters[K],
   ) => void;
   disabled?: boolean;
+  /** When false, hide the "Flatten PDF pages to images" option (e.g. in policies). */
+  showFlatten?: boolean;
 }
 
 const WatermarkFormatting = ({
   parameters,
   onParameterChange,
   disabled = false,
+  showFlatten = true,
 }: WatermarkFormattingProps) => {
   const { t } = useTranslation();
 
@@ -95,17 +98,19 @@ const WatermarkFormatting = ({
       </Group>
 
       {/* Advanced Options */}
-      <Checkbox
-        label={t(
-          "watermark.settings.convertToImage",
-          "Flatten PDF pages to images",
-        )}
-        checked={parameters.convertPDFToImage}
-        onChange={(event) =>
-          onParameterChange("convertPDFToImage", event.currentTarget.checked)
-        }
-        disabled={disabled}
-      />
+      {showFlatten && (
+        <Checkbox
+          label={t(
+            "watermark.settings.convertToImage",
+            "Flatten PDF pages to images",
+          )}
+          checked={parameters.convertPDFToImage}
+          onChange={(event) =>
+            onParameterChange("convertPDFToImage", event.currentTarget.checked)
+          }
+          disabled={disabled}
+        />
+      )}
     </Stack>
   );
 };