Implement OPA adapter for agent self-protection template

[fraware]

Goal

Implement the first end-to-end OVK adapter for the agent-cannot-disable-own-ci-gate template.

Scope

• Add ovk/adapters/opa/ implementation.
• Load adapters/opa/capability.json.
• Compile the self-protection intent into a Rego input object.
• Run OPA CLI or library.
• Normalize OPA violations into VerificationEvidence.
• Add tests with a failing fixture where ovk-verify is removed from required checks.

Acceptance criteria

• ovk run or equivalent adapter call returns fail for the fixture.
• Evidence includes backend, guarantee type, assumptions, limits, counterexample, and block decision.
• Unknown metadata is reported as unknown, never pass.

[fraware]

Implementation progress:

• Added ovk/adapters/opa/self_protection.py
• Added adapter package initialization
• Added failing and passing fixtures in examples/no_agent_self_approval/
• Added scripts/run_self_protection_demo.py
• Added tests/test_opa_self_protection.py
• Added docs/FIRST_DEMO.md

The current path uses a deterministic Python evaluator for the first OPA-style policy so the demo can run in CI without requiring the OPA binary. Next step: connect the same semantics to actual OPA CLI execution.