Land foundations: assessment, ADR-001/002/003, FLEX-WP-0005, Go skeleton

Pre-implementation assessment and boundary review
(docs/pre-implementation-assessment.md) lead to three ADRs:
- ADR-001 Go + repo skeleton
- ADR-002 Rego-in-Markdown policy package format
- ADR-003 Topaz-aligned MVP (Topaz spike moves into foundations)

New workplan FLEX-WP-0005 (Foundations and Topaz Alignment) is inserted
between WP-0001 (done) and WP-0002 (core). WP-0002 pins Rego-in-Markdown
for P2.3; WP-0004 P4.1 refocused from Topaz evaluation to Topaz adapter.

Go skeleton at repo root: cmd/flex-auth + internal/{registry,policy,
decision,audit,adapters} + pkg/api + Makefile + .golangci.yml + GitHub
Actions CI. make ci green locally; bin/flex-auth --version works.

INTENT/SCOPE cite the NetKingdom IAM Profile and add the ops-warden /
ops-bridge disjoint-surface clarifications.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Makefile

@@ -0,0 +1,54 @@
+BIN_DIR ?= bin
+BIN     := $(BIN_DIR)/flex-auth
+PKG     := ./...
+VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo 0.0.0-dev)
+LDFLAGS := -X main.version=$(VERSION)
+
+.PHONY: all build test vet lint fmt tidy sbom clean ci
+
+all: vet lint test build
+
+build:
+	@mkdir -p $(BIN_DIR)
+	go build -ldflags "$(LDFLAGS)" -o $(BIN) ./cmd/flex-auth
+
+test:
+	go test -race $(PKG)
+
+vet:
+	go vet $(PKG)
+
+fmt:
+	gofmt -l -w .
+
+tidy:
+	go mod tidy
+
+lint:
+	@if command -v golangci-lint >/dev/null 2>&1; then \
+		golangci-lint run $(PKG); \
+	else \
+		echo "golangci-lint not installed; run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest"; \
+		echo "falling back to: go vet"; \
+		go vet $(PKG); \
+	fi
+
+sbom:
+	@mkdir -p $(BIN_DIR)
+	@if command -v cyclonedx-gomod >/dev/null 2>&1; then \
+		cyclonedx-gomod mod -json -output $(BIN_DIR)/sbom.cdx.json .; \
+		echo "SBOM written to $(BIN_DIR)/sbom.cdx.json (cyclonedx-gomod)"; \
+	elif command -v syft >/dev/null 2>&1; then \
+		syft . -o cyclonedx-json=$(BIN_DIR)/sbom.cdx.json; \
+		echo "SBOM written to $(BIN_DIR)/sbom.cdx.json (syft)"; \
+	else \
+		echo "no SBOM tool found. install one:"; \
+		echo "  go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest"; \
+		echo "  or syft: https://github.com/anchore/syft"; \
+		exit 1; \
+	fi
+
+clean:
+	rm -rf $(BIN_DIR)
+
+ci: vet lint test build