OPA pack allowlists

When kya.opa.enabled=true, pack action allowlists can be evaluated via OPA. A deny from OPA becomes DENY at the evaluate path.

OPA does not replace human approval when policy needs a person. See ADR 0004 and docs/dev/kya-opa.md in the repository.