Implement a scalable policy loading strategy

[mariajgrimaldi]

Description

The framework currently loads the full policy set into memory. While this worked for Ulmo’s MVP and passed load tests up to ~100 concurrent users, this approach may not scale as policies and scope types increase. Earlier work explored loading only relevant subsets of policies, but this was not finalized: #86

This issue tracks:

• Reviewing how policies are currently loaded into memory.
• Identifying the points in the system that depend on full-policy loading.
• Implementing a long-term strategy that avoids loading unnecessary policies while keeping enforcement correct.
• Ensuring the new strategy supports additional scopes beyond the MVP.

Acceptance Criteria

• There is a clear description of the current loading flow and its constraints.
• There is a documented list of components affected by changing the loading strategy.
• A first iteration of an implementation that avoids loading the entire policy set when not required.
• Follow-up tasks if further refinements are needed.