feat(policy): establish one canonical authored policy representation

[johnnygreco]

Summary

Establish one dependency-light representation of the complete authored OpenShell policy format so runtime loading and policy-analysis consumers share the same schema, parsing, defaults, and intrinsic policy-language behavior.

Related Issue

Closes #3333.

Changes

• Add openshell-policy-schema as the owner of authored policy types, bounded parsing, serialization, and pure validation.
• Preserve authoring-time presence, closed-object extensions, and open user-data maps.
• Keep runtime protobuf messages and prover models as consumer-specific derived representations.
• Migrate openshell-policy and the existing risk prover to the shared authored representation.
• Preserve compatibility adapters and document intentional behavior corrections.

Testing

• Schema round-trip and parser-limit tests
• Runtime/protobuf conversion and validation tests
• Cross-consumer parity and existing-prover projection tests
• mise run pre-commit
• mise run test
• mise run e2e:docker
• mise run ci

Checklist

• Follows Conventional Commits
• Commits are signed off
• Architecture documentation is updated
• User-facing policy documentation is updated

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3318.docs.buildwithfern.com/openshell

[johnnygreco]

Superseded by #3334, opened from the clean issue-backed branch 3333-policy-schema/jg against main.