feat: scaffold deployment-policies monorepo

OPA/Rego deployment gateway policies: 5 rules (valid-environment,
require-approvals, no-self-approval, block-weekends, freeze-window),
a deploy-gate combining them, JSON schemas, scenario-driven tests,
Gitea Actions CI (verify + publish to generic registry), changesets
versioning, Makefile and scripts.

policies/gates/deploy-gate/gate_test.rego

@@ -0,0 +1,49 @@
+# METADATA
+# schemas:
+#   - input: schema["input"]
+#   - data: schema["data"]
+
+package gate.deploy_gate_test
+
+import data.rules.block_weekends as block_weekends
+import data.rules.freeze_window as freeze_window
+import data.rules.no_self_approval as no_self_approval
+import data.rules.require_approvals as require_approvals
+import data.rules.valid_environment as valid_environment
+import rego.v1
+
+violations_for[scenario_name] contains code if {
+	some scenario_name, scenario in data.scenarios
+	some v in valid_environment.violations with input as scenario.input with data.deploygate as scenario.data
+	code := v.code
+}
+
+violations_for[scenario_name] contains code if {
+	some scenario_name, scenario in data.scenarios
+	some v in require_approvals.violations with input as scenario.input with data.deploygate as scenario.data
+	code := v.code
+}
+
+violations_for[scenario_name] contains code if {
+	some scenario_name, scenario in data.scenarios
+	some v in no_self_approval.violations with input as scenario.input with data.deploygate as scenario.data
+	code := v.code
+}
+
+violations_for[scenario_name] contains code if {
+	some scenario_name, scenario in data.scenarios
+	some v in block_weekends.violations with input as scenario.input with data.deploygate as scenario.data
+	code := v.code
+}
+
+violations_for[scenario_name] contains code if {
+	some scenario_name, scenario in data.scenarios
+	some v in freeze_window.violations with input as scenario.input with data.deploygate as scenario.data
+	code := v.code
+}
+
+test_scenario[scenario_name] if {
+	some scenario_name, scenario in data.scenarios
+	expected := {code | code := scenario.expect.violations[_]}
+	{code | code := violations_for[scenario_name][_]} == expected
+}