Generic HTTP-primitive policy rules for Gate

[bmbouter]

Summary

• Replaces bespoke per-service operation-name scope checking with generic HTTP method+host+path glob rules
• Named rule sets defined in .alcove/policy-rules/*.yml, synced to DB, referenced by security profiles
• Security profiles gain rules: key for named rule references and inline HTTP rules
• Ships with 73 named rule sets covering all GitHub/GitLab/Jira/Splunk operations from scope.go
• Full backward compatibility: existing tools: profiles still work unchanged

Architecture

.alcove/policy-rules/github.yml  →  sync to DB  →  profile resolves refs
     ↓                                                    ↓
named rule sets                              flat []PolicyRule
     ↓                                                    ↓
security profile rules:                      GATE_POLICY_RULES env var
  - github-read-issues                              ↓
  - github-create-comment                    Gate CheckPolicyRules()

Test plan

• go build ./... passes
• go test ./... — all packages pass (including 60+ new policy tests)
• DB migrations apply cleanly (policy_rule_sets table + security_profiles.rules column)
• Bridge starts with new migrations
• CI passes

🤖 Generated with Claude Code