feat: scaffold deployment-policies monorepo

OPA/Rego deployment gateway policies: 5 rules (valid-environment,
require-approvals, no-self-approval, block-weekends, freeze-window),
a deploy-gate combining them, JSON schemas, scenario-driven tests,
Gitea Actions CI (verify + publish to generic registry), changesets
versioning, Makefile and scripts.

.changeset/README.md

@@ -0,0 +1,38 @@
+# Changesets
+
+This repository uses [Changesets](https://github.com/changesets/changesets) to version the OPA
+policy packages. Every `policies/rules/*` and `policies/gates/*` package is an independent npm
+workspace; changesets records which packages changed so versions can be bumped consistently.
+
+## Adding a changeset
+
+Run from the repository root:
+
+```sh
+make changeset
+```
+
+It opens an interactive prompt: select the packages you changed, the bump type (`patch` for
+fixes/behaviour tweaks, `minor` for new rules, `major` for breaking input/data contract changes)
+and a summary. This writes a file under `.changeset/`.
+
+Commit the changeset file together with your policy code changes.
+
+## Releasing
+
+When changesets are present on `main`, run:
+
+```sh
+make version
+```
+
+This applies all changesets, rewrites the `version` field of affected `package.json`s and
+regenerates `CHANGELOG.md` files (formatted with `oxfmt`). Commit the resulting bump.
+
+Bundles are built from `package.json#version`, so the registry upload uses the new version.
+
+## Gitea Actions
+
+CI verifies (format, lint, schema check, tests) and builds bundles on every push/PR. On `main`
+the `publish` job uploads the bundles to the Gitea generic package registry using the
+`GITEA_TOKEN` repository secret (requires `write:package` scope).