feat: scaffold deployment-policies monorepo

OPA/Rego deployment gateway policies: 5 rules (valid-environment,
require-approvals, no-self-approval, block-weekends, freeze-window),
a deploy-gate combining them, JSON schemas, scenario-driven tests,
Gitea Actions CI (verify + publish to generic registry), changesets
versioning, Makefile and scripts.

scripts/common.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Shared helpers for policy management scripts.
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+POLICIES_DIR="$ROOT_DIR/policies"
+TOOLS_DIR="$ROOT_DIR/tools"
+OPA="$TOOLS_DIR/opa"
+ARTIFACTS_DIR="$ROOT_DIR/dist"
+
+repo_name() {
+  node -p "require('$1/package.json').name"
+}
+
+repo_version() {
+  node -p "require('$1/package.json').version"
+}