feat: scaffold deployment-policies monorepo

OPA/Rego deployment gateway policies: 5 rules (valid-environment,
require-approvals, no-self-approval, block-weekends, freeze-window),
a deploy-gate combining them, JSON schemas, scenario-driven tests,
Gitea Actions CI (verify + publish to generic registry), changesets
versioning, Makefile and scripts.

policies/rules/valid-environment/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "valid-environment",
+  "version": "0.0.0",
+  "description": "Denies deployments to environments that are not configured in data.deploygate.config.",
+  "private": true
+}

policies/rules/valid-environment/policy.rego

@@ -0,0 +1,19 @@
+# METADATA
+# schemas:
+#   - input: schema["input"]
+#   - data: schema["data"]
+
+package rules.valid_environment
+
+import rego.v1
+
+default allow := false
+
+allow if {
+	count(violations) == 0
+}
+
+violations contains {"code": "unknown_environment", "message": sprintf("environment %q is not configured", [input.deployment.environment])} if {
+	input.deployment
+	not data.deploygate.config[input.deployment.environment]
+}

policies/rules/valid-environment/policy_test.rego

@@ -0,0 +1,12 @@
+package rules.valid_environment_test
+
+import data.rules.valid_environment as rule
+import rego.v1
+
+test_scenarios[scenario_name] if {
+	some scenario_name, scenario in data.scenarios
+	actual := {code | code := rule.violations[_].code} with input as scenario.input with data.deploygate as scenario.data
+	expected := {code | code := scenario.expect.violations[_]}
+	actual == expected
+	rule.allow == scenario.expect.allow with input as scenario.input with data.deploygate as scenario.data
+}

policies/rules/valid-environment/scenarios.json

@@ -0,0 +1,50 @@
+{
+  "scenarios": {
+    "valid_production": {
+      "input": {
+        "deployment": {
+          "environment": "production",
+          "service": "payments-api",
+          "version": "1.2.3",
+          "requested_by": "alice",
+          "created_at": "2026-09-15T10:00:00Z"
+        },
+        "approvals": [
+          {"by": "bob", "at": "2026-09-15T09:00:00Z", "active": true}
+        ]
+      },
+      "data": {
+        "config": {
+          "production": {"min_approvals": 2, "block_weekends": true}
+        }
+      },
+      "expect": {
+        "allow": true,
+        "violations": []
+      }
+    },
+    "unknown_environment": {
+      "input": {
+        "deployment": {
+          "environment": "production",
+          "service": "payments-api",
+          "version": "1.2.3",
+          "requested_by": "alice",
+          "created_at": "2026-09-15T10:00:00Z"
+        },
+        "approvals": [
+          {"by": "bob", "at": "2026-09-15T09:00:00Z", "active": true}
+        ]
+      },
+      "data": {
+        "config": {
+          "staging": {"min_approvals": 1}
+        }
+      },
+      "expect": {
+        "allow": false,
+        "violations": ["unknown_environment"]
+      }
+    }
+  }
+}

policies/rules/valid-environment/schema/data.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "additionalProperties": true,
+  "properties": {
+    "deploygate": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": ["config"],
+      "properties": {
+        "config": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object"
+          }
+        }
+      }
+    },
+    "rules": {
+      "type": "object",
+      "additionalProperties": true
+    }
+  }
+}

policies/rules/valid-environment/schema/input.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "additionalProperties": true,
+  "properties": {
+    "deployment": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": ["environment"],
+      "properties": {
+        "environment": {"type": "string"}
+      }
+    }
+  }
+}