Drush policy restriction doesn't restrict sql_sync
I added this to my sync_enable commandfile, and it definitely worked:

function drush_sync_enable_sql_sync_validate($source = NULL, $destination = NULL) {
  if (strpos($destination, 'live')) {
    return drush_set_error('DRUSH_BAD_DEVOPS_NO_BISCUIT', dt("Don't sync to live."));
  }
}


That looks the same as what you've got, so the next thing I'd recommend that you try is drush cc drush, to clear the Drush commandfile cache.  That will insure that Drush can see your policy file.

UPDATE:

Sorry, the problem was that Drush looks for site-wide commandfiles in '/usr/share/drush/commands', not '/etc/drush'.  Move your policy file there, and then drush cc drush, and it should work.