feat(workflow): dynamic policy + workflow engine

[haydercyber]

Summary

Piece 2 of the dynamic-workflow vertical slice. Everything an operator might want to tune — roles, who approves what, TTLs, separation of duties — is now rows, not constants. Admin UI (Piece 5) edits these tables; PolicyEngine resolves the right workflow for a given request scope at runtime.

Schema (migration 0005)

Table	Purpose
roles	Admin-defined permission bundles
user_roles	RBAC assignments with optional scope narrowing (project, environment)
workflow_definitions	Approval templates (min_approvers, wrap_ttl_*, allow_self_approval, notification_channels, ...)
policy_rules	Selector → workflow mapping with priority-based resolution

Plus seed rows so the platform starts in a usable state:

• System admin / approver / developer roles
• System standard workflow as is_default
• System match-all policy at priority 0 (any operator-added rule wins)

Resolution algorithm

PolicyEngine.Resolve(ctx, scope) → (*Workflow, *PolicyRule, error)

1. Walk enabled rules in priority DESC, created_at ASC order.
2. First rule whose selector is a SUBSET of the scope wins.
   (Every present selector key must match; absent keys are wildcards.
    `secret_ref_prefix` is prefix-match; everything else exact.)
3. Disabled rule OR disabled target workflow → continue walking.
4. No rule matched → fall back to is_default=true workflow.
5. No default → ErrNoDefaultWorkflow (operator misconfig — 500 at the API).

Hard rules

Invariant	How enforced
Operator can't accidentally delete the default workflow	Partial unique index workflow_definitions_one_default + is_system=true on the seed row. Delete returns ErrSystemRow.
Disabled rule / workflow falls through, doesn't fail	Resolve continues the walk; tests pin both cases.
Higher priority wins on overlapping selectors	Repository's ListEnabledOrderedByPriority returns pre-sorted.
Single default workflow	Partial unique index — can't be bypassed by misbehaving service-layer caller.

Decisions worth flagging

Decision	Why
Selector keys are wildcards when absent, exact-match (or prefix-match for secret_ref_prefix) when present	Operator intuition: "this rule applies when env=prod" — they don't list everything they don't care about.
Match-all policy at priority 0	Any operator-added rule at default priority 100 wins immediately.
is_default enforced by partial unique index	Schema guarantees exactly one default.
is_system rows editable but not deletable	Protects the seed without making it totally immutable. Operator can change the default workflow's TTLs but can't kubectl delete the row.
Permissions are opaque strings	Lets new permissions land without a Go-side type change. Wildcard (secret.*) is future.
Resolve queries DB on every call	Simple, correct. In-memory cache with invalidation-on-edit is a follow-up.
TRUNCATE not DELETE for audit_events in test setup	Append-only trigger from Step 5 rejects DELETE; TRUNCATE bypasses row triggers. Pattern documented.

Verification

Offline: go build / vet / test -race ./... clean.
Live: 10 new tests pass; full suite (-p 1 across all packages) green.

=== RUN   TestResolve_FallsBackToSystemDefault           PASS
=== RUN   TestResolve_ExactMatchPolicyTakesPrecedence    PASS
=== RUN   TestResolve_HigherPriorityWins                 PASS
=== RUN   TestResolve_PartialMatchDoesNotApply           PASS
=== RUN   TestResolve_SecretRefPrefixMatch               PASS
=== RUN   TestResolve_DisabledRuleSkipped                PASS
=== RUN   TestResolve_DisabledWorkflowFalsThrough        PASS
=== RUN   TestRoles_DeleteSystemRowRejected              PASS
=== RUN   TestUserRoles_GrantAndList                     PASS
=== RUN   TestWorkflows_OnlyOneDefault                   PASS

Test plan

• CI green (4 jobs)
• Local full suite with -p 1 clean
• Reviewer reads internal/services/policy.go::Resolve and confirms the walk + fall-through logic
• Reviewer reads pkg/storage/migrations/0005_workflow_engine.up.sql and confirms the seed rows fit the platform-starts-usable principle
• Reviewer reads the partial unique index on is_default and confirms it can't admit two defaults at once

What's NOT in this PR (next pieces)

Piece	Adds
3	HTTP endpoints — admin role/workflow/policy CRUD, dev request submission, approver queue, agent wrap retrieval
4	Agent ProviderExecutor consuming wraps + writing to providers
5	UI scaffold + admin pages
6	UI dev + approver pages