feat: scaffold deployment-policies monorepo

OPA/Rego deployment gateway policies: 5 rules (valid-environment,
require-approvals, no-self-approval, block-weekends, freeze-window),
a deploy-gate combining them, JSON schemas, scenario-driven tests,
Gitea Actions CI (verify + publish to generic registry), changesets
versioning, Makefile and scripts.

scripts/check.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Lints, schema-checks and tests every rule and gate.
+
+set -euo pipefail
+
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/common.sh"
+
+fail() {
+  echo "FAIL: $1" >&2
+  exit 1
+}
+
+# Rego formatting.
+echo "==> opa fmt --fail"
+"$OPA" fmt --fail --diff "$POLICIES_DIR" || fail "rego files are not formatted (run 'make fmt' or 'opa fmt -w')"
+
+# Lint with regal if available.
+if command -v regal >/dev/null 2>&1; then
+  echo "==> regal lint"
+  regal lint "$POLICIES_DIR" --format github || fail "regal lint found issues"
+else
+  echo "==> regal not found, skipping"
+fi
+
+RULES_ARG=""
+rule_dirs=( "$POLICIES_DIR"/rules/*/ )
+[ "${#rule_dirs[@]}" -gt 0 ] && [ -d "${rule_dirs[0]}" ] || fail "no rules found"
+
+# Schema-check + unit tests per rule (runs are isolated so each rule's scenarios.json loads at data.scenarios).
+for d in "${rule_dirs[@]}"; do
+  name="$(basename "$d")"
+  echo "==> check ${name}"
+  "$OPA" check --strict --schema "$d/schema" "$d/policy.rego" "$d/policy_test.rego" || fail "check ${name}"
+  echo "==> test ${name}"
+  "$OPA" test "$d/policy.rego" "$d/policy_test.rego" "$d/scenarios.json" || fail "test ${name}"
+  RULES_ARG="$RULES_ARG $d/policy.rego"
+done
+
+# Gates: check + tests with all rule policy.rego files loaded so data.rules.* resolves.
+gate_dirs=( "$POLICIES_DIR"/gates/*/ )
+for g in "${gate_dirs[@]}"; do
+  [ -d "$g" ] || continue
+  name="$(basename "$g")"
+  echo "==> check ${name}"
+  "$OPA" check --strict --schema "$g/schema" "$g/gate_test.rego" || fail "check ${name}"
+  echo "==> test ${name}"
+  # shellcheck disable=SC2086
+  "$OPA" test "$g/gate_test.rego" "$g/scenarios.json" $RULES_ARG || fail "test ${name}"
+done
+
+echo "All checks passed."