feat: scaffold deployment-policies monorepo

OPA/Rego deployment gateway policies: 5 rules (valid-environment,
require-approvals, no-self-approval, block-weekends, freeze-window),
a deploy-gate combining them, JSON schemas, scenario-driven tests,
Gitea Actions CI (verify + publish to generic registry), changesets
versioning, Makefile and scripts.

policies/rules/require-approvals/policy.rego

@@ -0,0 +1,34 @@
+# METADATA
+# schemas:
+#   - input: schema["input"]
+#   - data: schema["data"]
+
+package rules.require_approvals
+
+import rego.v1
+
+default allow := false
+
+allow if {
+	count(violations) == 0
+}
+
+violations contains {"code": "insufficient_approvals", "message": sprintf("need at least %d approval(s), got %d", [min_approvals, count(active_approvals)])} if {
+	cfg := data.deploygate.config[input.deployment.environment]
+	cfg.min_approvals > 0
+	count(active_approvals) < cfg.min_approvals
+}
+
+min_approvals := data.deploygate.config[input.deployment.environment].min_approvals if {
+	input.deployment
+}
+
+active_approvals contains approval if {
+	some approval in input.approvals
+	approval.active
+}
+
+violations contains {"code": "not_configured", "message": sprintf("no min_approvals configured for environment %q", [input.deployment.environment])} if {
+	input.deployment
+	not data.deploygate.config[input.deployment.environment].min_approvals
+}