fix: policy always checked regardless of caller-provided floors

Redesign addVisitor four-phase flow:
- Phase1: ALWAYS query person detail (orgIds for policy lookup)
- Phase2: candidate = caller floors or org floorList
- Phase3: ALWAYS check policy; intersect candidate with allow
- Phase4: empty set validation
Fixes UC-02 bypass: policy was entirely skipped when caller
provided floorIds. Now policy always constrains.
Bump v2.0.19

maven-cw-elevator-application/releases/cw-elevator-application-V2.0.18.20260505/stop.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# 停止与本目录 cw-elevator-application-V1.0.0.20211103.jar 对应的 Java 进程（仅匹配命令行中含该 JAR 名的进程）。
+set -euo pipefail
+JAR="cw-elevator-application-V1.0.0.20211103.jar"
+# shellcheck disable=SC2009
+pid=$(ps -ef | grep '[j]ava' | grep "$JAR" | awk '{print $2}' || true)
+if [[ -n "${pid}" ]]; then
+  kill -9 $pid
+fi