chore: adopt engineering standard v1.0.0

Adopt the org engineering standard (its-consulting/standards @ v1.0.0).

Adds baseline governance/CI/policy files rendered from the standard's
templates and pins .standards-version=1.0.0. Vendored OPA/Rego policies
under .standards/policies/ so CI runs the gate locally (no cross-repo dep).
Placeholders ({{ORG}}/{{REPO}}/{{OWNER_HANDLE}}/{{MAINTAINER_EMAIL}}) filled in.
Existing files that differ were left untouched by the adopter.

Automated rollout. Files created: 15.

adr/0000-template.md

@@ -0,0 +1,69 @@
+---
+title: <Short decision title, imperative>
+status: Draft
+owner: alex
+review-date: YYYY-MM-DD
+---
+
+<!--
+ADR template — Michael Nygard format. Used by `make adr-new` and rendered by
+adopt-standard.sh into <repo>/docs/adr/NNNN-kebab-title.md.
+
+Rules (see docs/00-overview.md §5.2, §5.4):
+  - File name: NNNN-kebab-title.md, NNNN zero-padded (0009, 0010, …).
+  - The H1 number matches NNNN; the title matches front-matter `title`.
+  - status lifecycle: Draft -> Accepted -> Superseded. Immutable once Accepted —
+    to change a decision, write a NEW ADR that Supersedes this one.
+  - If this decision asserts an enforceable rule, name its counterparts under
+    "Enforced by": the SOP that operationalizes it and the Policy (+ *_test.rego)
+    that enforces it. Keep the ADR <-> SOP <-> Policy triangle intact.
+Delete this comment when you fill the template in.
+-->
+
+# NNNN. <Short decision title, imperative>
+
+## Status
+
+Draft — YYYY-MM-DD.
+<!-- When accepted: "Accepted — YYYY-MM-DD." When replaced: "Superseded by
+     [ADR-XXXX](XXXX-kebab-title.md) — YYYY-MM-DD." -->
+
+## Context
+
+<!-- The forces at play: technical, business, team. What problem or pressure makes
+     a decision necessary now? State facts and constraints, not the solution.
+     Be concrete and falsifiable. -->
+
+## Decision
+
+<!-- The change we are actually making, in active voice: "We will …".
+     One decision per ADR. Spell out the chosen option clearly enough that someone
+     can implement it without guessing. -->
+
+We will …
+
+## Consequences
+
+<!-- What becomes easier AND harder after this decision. List both. -->
+
+- Positive: …
+- Negative: …
+- Neutral / follow-ups: …
+
+## Alternatives considered
+
+<!-- Options you rejected and the one-line reason each lost. Optional but recommended. -->
+
+- **<Option>** — rejected because …
+
+## Enforced by
+
+<!-- Required when this ADR asserts an enforceable rule. Link the exact files:
+  - SOP:    ../../sops/SOP-NNN-<topic>.md
+  - Policy: ../../policies/<domain>/<name>.rego (+ tests/<name>_test.rego)
+  - CI:     ../../ci/github/reusable-*.yml | ../../ci/woodpecker/.woodpecker.*.yml
+  If purely advisory, write "Advisory — no machine enforcement." and say why. -->
+
+## References
+
+<!-- Related ADRs (supersedes/superseded-by), SOPs, external links. -->