chore: adopt engineering standard v1.0.0

Adopt the org engineering standard (its-consulting/standards @ v1.0.0).

Adds baseline governance/CI/policy files rendered from the standard's
templates and pins .standards-version=1.0.0. Vendored OPA/Rego policies
under .standards/policies/ so CI runs the gate locally (no cross-repo dep).
Placeholders ({{ORG}}/{{REPO}}/{{OWNER_HANDLE}}/{{MAINTAINER_EMAIL}}) filled in.
Existing files that differ were left untouched by the adopter.

Automated rollout. Files created: 15.

.standards/policies/conftest.toml

@@ -0,0 +1,18 @@
+# Conftest configuration for the `standards` Policy-as-Code package.
+#
+# Enforces: docs/adr/0004-policy-as-code-opa-conftest.md
+# Followed by: sops/SOP-002-release-process.md, sops/SOP-005-secrets-management.md
+#
+# Config keys mirror conftest's CLI flags (hyphenated). Conftest auto-discovers a
+# `conftest.toml` in the policy directory / working directory, so running
+# `conftest test <manifest>` from `policies/` picks these up with no extra flags.
+#
+# `all-namespaces = true` makes conftest evaluate `deny`/`warn` rules from EVERY
+# Rego package it loads (standards.ci.*, standards.quadlet.*, standards.containerfile.*),
+# so a single `conftest test <manifest>` exercises every relevant policy. Without it,
+# conftest only looks at the `main` namespace and silently ignores our namespaced rules.
+#
+# `policy = "."` points conftest at this directory (run it from `policies/`), so the
+# lib/, ci/, quadlet/ and containerfile/ subtrees are all discovered.
+policy = "."
+all-namespaces = true