feat(pdp-opa): embedded OPA/Rego policy decision point via regorus

[araujof]

Summary

Operators standardized on OPA/Rego previously had no in-process option in CPEX: their only choices were Cedar, CEL, or an external OPA server over HTTP. This adds cpex-pdp-opa, an embedded Rego policy decision point backed by the pure-Rust regorus interpreter, so existing Rego policy runs in-process with no sidecar and no network hop, alongside the cedar and cel builtins. It fills the PdpDialect::Opa dialect that already existed in apl-core, and ships enabled by default.

Closes #137.

Decision contract

A route's opa: { query: "data.authz.allow" } step evaluates the query against the request AttributeBag (mapped to the Rego input document). The query result maps to allow/deny:

Query result	Outcome
true / false	allow / deny
decision object	allow/deny read from a configurable field (default allow); on deny, reason/message and violations/errors flow into the CPEX violation
set / array (the deny[msg] idiom)	empty → allow, non-empty → deny with the elements as violations
undefined (no matching rule, no default)	clean deny

This covers the dominant Rego authoring styles (boolean rules, decision objects, and deny-sets) so existing policy ports over without a rewrite.

Design decisions

• Fail-closed by default. on_error: deny|allow (default deny) governs genuine eval errors and non-decision values. An undefined result is a clean deny independent of on_error (matching OPA's undefined-is-not-granted semantics, so on_error: allow cannot flip an ordinary non-match to allow). Rego parse errors, inline/global package collisions, and cache-full rejections always deny regardless of on_error — an author bug, a trust-boundary violation, and a resource limit must never fail open.
• Base engine, cloned per request. regorus's set_input/eval_* all take &mut self, so there is no shared-immutable eval path. A base Engine holds the compiled global modules and data; because the arc feature Arc-shares that state, each request clones the base cheaply, sets its own input, and evaluates — no lock on the hot path. Eval runs on spawn_blocking so a CPU-heavy Rego evaluation cannot monopolize an async worker.
• Security-scoped builtin surface. regorus is pinned default-features = false with an explicit allow-list that excludes http, net, opa-runtime, and jsonschema, keeping network egress and runtime introspection out of reach of policy authors. A regression test pins that http.send is unavailable.
• Inline-module trust boundary. A route step may carry an inline module, but one whose Rego package collides with a global-module package is rejected fail-closed — inline modules may add new packages but cannot merge into and override operator policy.
• apl-core-only at compile time. The crate depends only on apl-core (plus regorus and a tokio runtime for spawn_blocking); apl-cpex/cpex-core are dev-deps for the e2e test. Wiring is a one-feature-one-crate addition to cpex-builtins.

Notes

Deny diagnostics serialize the full policy-authored decision object with no size cap. It is latent (no consumer reads PdpDecision.diagnostics outside the PDP crates today) and worth bounding before an audit sink consumes it.

Tests

57 unit tests (bag→input mapping, config parsing and strictness, the full decision contract, on_error both ways, compile-vs-runtime asymmetry, inline-module isolation, cache cap, concurrency) plus 6 end-to-end tests driving config through the apl-cpex visitor (allow/deny, deny-set idiom, external data, load-time rejection, missing-query). cargo deny check passes with no license/source/ban changes.