feat(pr-policy): add role separation gate

[ArchonVII]

Summary

• Adds a pure scripts/role-policy.mjs helper for F7 role-separation decisions.
• Wires pr-policy.yml to warn by default and optionally hard-fail protected agent-managed PRs without independent Release-Admiral approval/marker.
• Documents the new pr-policy inputs and owner-maintenance non-exemption in README/example caller docs.

Linked Issue

Closes #26

Scope

• In scope:
  • pr-policy.yml role-separation warning and opt-in hard gate.
  • Unit tests for soft warning, protected-path hard block, Release-Admiral approval/marker, owner-maintenance PR non-exemption, and Dependabot exception.
  • README/example documentation for consumers.
• Out of scope:
  • repo-template owner-maintenance hook/docs behavior; tracked separately in F7 follow-up: Owner Maintenance Lane docs and hooks repo-template#21.
  • Retagging v1; do that after review/merge if this should ship to existing consumers pinned to @v1.

Changelog

N/A: this repo does not currently use changelog fragments.

Verification

Verification Notes

• Tests pass

  command: npm test
  location: local
  result: 3 files passed, 63 tests passed
  timestamp: 2026-05-29T00:01:49Z
  

• Whitespace check passes

  command: git diff origin/main...HEAD --check
  location: local
  result: passed with no output
  timestamp: 2026-05-29T00:01:49Z
  

• Local actionlint

  command: actionlint -version; npx --yes actionlint -version; go version
  location: local
  result: unavailable locally; actionlint not installed, npx package had no executable, go not installed
  timestamp: 2026-05-29T00:01:59Z
  

Risks

• Risk level: Medium. This changes reusable PR policy behavior, but the hard gate is opt-in and the default behavior is warning-only.
• Rollback: Revert this PR, or consumers can leave enforce-role-separation unset/false.
• Follow-ups:
  • Decide whether to fast-forward the v1 tag after this merges.
  • Complete F7 follow-up: Owner Maintenance Lane docs and hooks repo-template#21 for Owner Maintenance Lane hook/docs behavior.