dehop: dehop_policy returns a policy that can run on any switch