We enforce policy push/pop balance around any scope that pushes/pops a
snapshot.  Therefore a snapshot may never reference entries of
PolicyStack that were created in nested scopes.  Free storage of
short-lived policy stack entries when they are popped.