Land foundations: assessment, ADR-001/002/003, FLEX-WP-0005, Go skeleton

Pre-implementation assessment and boundary review
(docs/pre-implementation-assessment.md) lead to three ADRs:
- ADR-001 Go + repo skeleton
- ADR-002 Rego-in-Markdown policy package format
- ADR-003 Topaz-aligned MVP (Topaz spike moves into foundations)

New workplan FLEX-WP-0005 (Foundations and Topaz Alignment) is inserted
between WP-0001 (done) and WP-0002 (core). WP-0002 pins Rego-in-Markdown
for P2.3; WP-0004 P4.1 refocused from Topaz evaluation to Topaz adapter.

Go skeleton at repo root: cmd/flex-auth + internal/{registry,policy,
decision,audit,adapters} + pkg/api + Makefile + .golangci.yml + GitHub
Actions CI. make ci green locally; bin/flex-auth --version works.

INTENT/SCOPE cite the NetKingdom IAM Profile and add the ops-warden /
ops-bridge disjoint-surface clarifications.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

cmd/flex-auth/main.go

@@ -0,0 +1,30 @@
+// Command flex-auth is the CLI entry point for the flex-auth authorization
+// registry and control plane.
+//
+// At skeleton stage this binary only reports its version. Subcommands
+// (validate, load, test, check, batch-check, explain) are added in
+// FLEX-WP-0002.
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+)
+
+// version is set at build time via -ldflags "-X main.version=…".
+var version = "0.0.0-dev"
+
+func main() {
+	showVersion := flag.Bool("version", false, "print version and exit")
+	flag.Parse()
+
+	if *showVersion || (flag.NArg() > 0 && flag.Arg(0) == "version") {
+		fmt.Println(version)
+		return
+	}
+
+	fmt.Fprintln(os.Stderr, "flex-auth: no subcommand yet (skeleton stage — see workplans/FLEX-WP-0002).")
+	fmt.Fprintln(os.Stderr, "Try: flex-auth --version")
+	os.Exit(64) // EX_USAGE
+}

cmd/flex-auth/main_test.go

@@ -0,0 +1,9 @@
+package main
+
+import "testing"
+
+func TestVersionDefault(t *testing.T) {
+	if version == "" {
+		t.Fatal("version must not be empty")
+	}
+}