Michael, can you give pointers on how to test this, and/or cc anyone else who might be able to help?

Adapted from https://www.chromium.org/developers/how-tos/enterprise/running-the-cloud-policy-test-server:

Create policy files in $HOME/policy-server:

  device_management: http://pastebin.com/raw/g0WBHUQW
  policy_google_chromeos_device.txt: http://pastebin.com/raw/2vqs49MD

Optionally (for user policies):

  policy_google_chromeos_user.txt (example: http://pastebin.com/raw/1Gigd5k4)

Then run the policy server:

1. Build targets: chrome py_proto policy device_policy_proto
   (seems to require a component build)
2. Run in a shell:

  POLICY_FILES=$HOME/policy-server
  OUT=out_cros/Release # or whatever

  source $HOME/venv/bin/activate
  PYTHONPATH="third_party/tlslite:net/tools/testserver"
  PYTHONPATH+=":$OUT/pyproto:$OUT/pyproto/chrome/browser/chromeos/policy/proto"
  PYTHONPATH+=":$OUT/pyproto/components/policy/proto"
  export PYTHONPATH
  python chrome/browser/policy/test/policy_testserver.py \
    --data-dir $POLICY_FILES --host localhost --port 8889 \
    --log-level DEBUG --log-to-console 

3. Launch chrome with:
    --device-management-url='http://localhost:8889' --disable-policy-key-verification \
    --login-manager --login-profile=user

4. Enroll the device. Use chrome://policy to refresh policy after changing files in $POLICY_FILES.

Local management is done in /etc/chromium/policies/.

See also: https://www.chromium.org/administrators/policy-list-3

To set up virtualenv ($HOME/venv/ above, but I put under my chrome/ directory):

$ cd /path/to/chrome
$ sudo pip install virtualenv
$ cd ..
$ virtualenv env
$ source env/bin/activate
(env) $ cd src
(env) $ python chrome/browser/policy/test/policy_testserver.py --data-dir $POLICY_FILES --host localhost --port 8889 --log-level DEBUG --log-to-console

6. This appears to be correct now.
12. People section is already hidden for guest/public account login.
13. Appearance/themes is already hidden for guest/public account login.
14. On startup is already hidden for guest/public account login.
15. Downloads: "Disconnect Google Drive account" is already hidden for guest/public account login.

My best guess is that Google gives us a bunch of Python packages that conflict with the versions used in chromium, like protobuf or whatever. So the virtualenv simply hides those packages so we don't have that version conflict.

I've updated https://sites.google.com/a/chromium.org/dev/developers/how-tos/enterprise/running-the-cloud-policy-test-server with a line about running the command inside virtualenv if necessary.

Great, thanks!