feat: scaffold deployment-policies monorepo

OPA/Rego deployment gateway policies: 5 rules (valid-environment,
require-approvals, no-self-approval, block-weekends, freeze-window),
a deploy-gate combining them, JSON schemas, scenario-driven tests,
Gitea Actions CI (verify + publish to generic registry), changesets
versioning, Makefile and scripts.

policies/rules/freeze-window/policy.rego

@@ -0,0 +1,22 @@
+# METADATA
+# schemas:
+#   - input: schema["input"]
+#   - data: schema["data"]
+
+package rules.freeze_window
+
+import rego.v1
+
+default allow := false
+
+allow if {
+	count(violations) == 0
+}
+
+violations contains {"code": "deploy_in_freeze", "message": sprintf("deployment within freeze window starting %s ending %s", [window.start, window.end])} if {
+	some window in data.deploygate.freeze_windows
+	window.environment == input.deployment.environment
+	created := time.parse_rfc3339_ns(input.deployment.created_at)
+	created >= time.parse_rfc3339_ns(window.start)
+	created <= time.parse_rfc3339_ns(window.end)
+}