chore: adopt engineering standard v1.0.0 (#4)

Adopt the org engineering standard (its-consulting/standards @ v1.0.0).

Adds baseline governance/CI/policy files rendered from the standard's
templates and pins .standards-version=1.0.0. Vendored OPA/Rego policies
under .standards/policies/ so CI runs the gate locally (no cross-repo dep).
Placeholders ({{ORG}}/{{REPO}}/{{OWNER_HANDLE}}/{{MAINTAINER_EMAIL}}) filled in.
Existing files that differ were left untouched by the adopter.

Automated rollout. Files created: 15.

CODEOWNERS

@@ -0,0 +1,21 @@
+# CODEOWNERS — rendered by adopt-standard.sh.
+# Review is REQUIRED from an owner before merge (enforce via branch protection
+# on develop/main). Replace Kenearos with your Forgejo/GitHub org handle.
+# See SOP-001 (branch & merge) and CONTRIBUTING.md.
+
+# Default — everything
+*                       @Kenearos
+
+# Governance & decisions — change deliberately
+/docs/                  @Kenearos
+/docs/adr/              @Kenearos
+/sops/                  @Kenearos
+
+# Enforcement & security-relevant paths — always require an owner
+/.github/               @Kenearos
+/ci/                    @Kenearos
+/policies/              @Kenearos
+/secrets/               @Kenearos
+/SECURITY.md            @Kenearos
+/CODEOWNERS             @Kenearos
+/.pre-commit-config.yaml @Kenearos