chore: adopt engineering standard v1.0.0

Adopt the org engineering standard (its-consulting/standards @ v1.0.0).

Adds baseline governance/CI/policy files rendered from the standard's
templates and pins .standards-version=1.0.0. Vendored OPA/Rego policies
under .standards/policies/ so CI runs the gate locally (no cross-repo dep).
Placeholders ({{ORG}}/{{REPO}}/{{OWNER_HANDLE}}/{{MAINTAINER_EMAIL}}) filled in.
Existing files that differ were left untouched by the adopter.

Automated rollout. Files created: 15.

.standards/policies/ci/secrets_in_env.rego

@@ -0,0 +1,72 @@
+# Secrets hygiene in pipeline / runtime environment blocks.
+#
+# Enforces:  docs/adr/0003-secrets-sops-age-fido2.md
+#            docs/adr/0004-policy-as-code-opa-conftest.md
+# SOP:       sops/SOP-005-secrets-management.md  (no plaintext secrets; SOPS+age + EnvironmentFile)
+# Input:     a descriptor with an environment map and optional metadata:
+#   {
+#     "environment": "staging",
+#     "env": { "LOG_LEVEL": "info", "API_TOKEN": "${API_TOKEN}" },
+#     "env_files": ["%h/.config/mypods/api.env"],
+#     "env_origin": { "DB_PASSWORD": "prod" }   # optional: which env a secret was sourced from
+#   }
+#
+# Rules:
+#   deny  - a secret-NAMED env var whose VALUE is an inlined plaintext secret
+#           (not a ${VAR}/%VAR% reference and not empty)
+#   deny  - any env VALUE that matches a known secret shape (PEM key, token prefix)
+#   deny  - a secret sourced from a 'prod' origin used in a non-prod ('staging'/'dev') env
+#   warn  - secret-named vars present but no EnvironmentFile declared (should use SOPS+age file)
+package standards.ci.secrets
+
+import rego.v1
+
+import data.standards.lib
+
+prod_envs := {"prod", "production"}
+
+is_prod if {
+	prod_envs[lower(input.environment)]
+}
+
+env := object.get(input, "env", {})
+
+env_files := object.get(input, "env_files", [])
+
+# --- Plaintext secret in a secret-named variable ----------------------------
+
+deny contains msg if {
+	some k, val in env
+	lib.looks_like_secret_name(k)
+	is_string(val)
+	not lib.is_placeholder(val)
+	msg := sprintf("env '%v' looks like a secret but holds an inline value; reference it via SOPS+age/EnvironmentFile instead (SOP-005)", [k])
+}
+
+# --- Value that matches a known secret shape, regardless of the var name -----
+
+deny contains msg if {
+	some k, val in env
+	lib.looks_like_secret_value(val)
+	not lib.is_placeholder(val)
+	msg := sprintf("env '%v' value matches a secret pattern (private key / token); never commit plaintext secrets (SOP-005)", [k])
+}
+
+# --- Cross-environment secret bleed: prod secret used in a lower env ---------
+
+deny contains msg if {
+	not is_prod
+	origin := object.get(input, "env_origin", {})
+	some k, src in origin
+	lower(src) == "prod"
+	msg := sprintf("env '%v' is sourced from a PROD secret but used in '%v'; environments must not share secret material (ADR-0006, SOP-005)", [k, input.environment])
+}
+
+# --- Advisory: secret-named vars but no EnvironmentFile pattern --------------
+
+warn contains msg if {
+	some k, _ in env
+	lib.looks_like_secret_name(k)
+	count(env_files) == 0
+	msg := sprintf("env '%v' is secret-shaped but no EnvironmentFile is declared; load secrets from a SOPS-decrypted env file (SOP-005)", [k])
+}