Generates Ash policies from workflow step declarations.

Ensures workflow resources work out of the box when Authorizer is present by injecting four layers of policies:

1. AshOban bypass — allows Oban-triggered actions (automatic steps and timeouts) to execute without an actor. Uses AshOban.Checks.AshObanInteraction which only matches when context.private.ash_oban? is true.

2. Step-level policies — for each manual step with a policy field, generates a policy scoped to that step's transition actions. For example:

   step :review do
     policy actor_attribute_equals(:role, :reviewer)
     transition :approve, to: :done
     transition :reject, to: :rejected
   end

   Generates:

   policy action([:approve, :reject]) do
     authorize_if {Ash.Policy.Check.ActorAttributeEquals, ...}
   end

3. Undo policy — when the workflow declares undo do policy ... end, a policy scoped to the generated :undo action.

4. Default allow — a catch-all authorize_if always() scoped to workflow transition actions, automatic step actions, timeout actions, read actions, and user-defined create actions, so workflow initialization and background execution aren't blocked by other policies on the resource.

Skips all policy generation if Authorizer is not configured on the resource.