Add policy configuration for scopes and approval rules

[safal207]

Goal

Move ProofPath from hardcoded minimal verifier behavior toward explicit policy configuration.

Why this matters

The current verifier demonstrates the core action-context rules. For real integrations, teams need configurable policies such as:

• which scopes are allowed;
• which scopes require approval;
• which reversibility class is allowed per scope;
• which action scopes are blocked by default;
• which approval references are accepted.

Proposed first version

Add a simple policy file format:

scopes:
  cicd.preview.deploy:
    allowed: true
    max_reversibility: reversible
    approval_required: false
  cicd.production.deploy:
    allowed: true
    max_reversibility: irreversible
    approval_required: true
  database.data.mutate:
    allowed: true
    max_reversibility: irreversible
    approval_required: true

Deliverables

• Add specs/policy-profile-v0.1.md.
• Add example policy files.
• Define scope allow/deny behavior.
• Define approval-required behavior.
• Define fallback behavior for unknown scopes.
• Add tests or conformance fixtures for policy behavior.
• Document how policy config relates to the current verifier.

Acceptance criteria

• The first policy profile is intentionally minimal.
• It does not overclaim enterprise policy completeness.
• Unknown scope behavior is explicit.
• Approval-required scope behavior is explicit.

Related

• Prepare ProofPath for external reviewers #32
• Add reviewer-facing conformance fixtures #48
• Add conformance fixture runner #52