chore: adopt engineering standard v1.0.0

Adopt the org engineering standard (its-consulting/standards @ v1.0.0).

Adds baseline governance/CI/policy files rendered from the standard's
templates and pins .standards-version=1.0.0. Vendored OPA/Rego policies
under .standards/policies/ so CI runs the gate locally (no cross-repo dep).
Placeholders ({{ORG}}/{{REPO}}/{{OWNER_HANDLE}}/{{MAINTAINER_EMAIL}}) filled in.
Existing files that differ were left untouched by the adopter.

Automated rollout. Files created: 15.

CODEOWNERS

@@ -0,0 +1,21 @@
+# CODEOWNERS — rendered by adopt-standard.sh.
+# Review is REQUIRED from an owner before merge (enforce via branch protection
+# on develop/main). Replace its-consulting with your Forgejo/GitHub org handle.
+# See SOP-001 (branch & merge) and CONTRIBUTING.md.
+
+# Default — everything
+*                       @its-consulting
+
+# Governance & decisions — change deliberately
+/docs/                  @its-consulting
+/docs/adr/              @its-consulting
+/sops/                  @its-consulting
+
+# Enforcement & security-relevant paths — always require an owner
+/.github/               @its-consulting
+/ci/                    @its-consulting
+/policies/              @its-consulting
+/secrets/               @its-consulting
+/SECURITY.md            @its-consulting
+/CODEOWNERS             @its-consulting
+/.pre-commit-config.yaml @its-consulting