Publish and validate the policy JSON schema

[giscebot]

Closes #198.

Summary

• publish a Draft 2020-12 schema with unknown-field rejection
• add gab validate-policy --policy PATH with dotted error locations and runtime semantic checks
• document editor/CLI usage and cover valid and invalid policies

Validation

• python3 -m pytest -q tests/test_validate_policy.py tests/test_policy.py (23 passed)
• PYTHONPATH=src python3 -m github_agent_bridge.cli validate-policy --policy policy.example.json
• built wheel and verified github_agent_bridge/policy.schema.json is packaged

Environment note

The full suite could not be collected in the system Python because the test-only fastapi dependency is absent and this host Python has neither pip nor ensurepip; targeted policy tests pass.

[ecarreras]

@giscebot recordaràs que quan es modifiqui l'estructura del policy també s'ha de modificar el validador?

[giscebot]

Sí. Ho tractaré com un contracte de manteniment: qualsevol canvi estructural de policy.json ha d’actualitzar al mateix PR Policy.from_file + policy.schema.json + policy.example.json/documentació + proves del cas nou i del rebuig corresponent.

Matís important d’aquest PR: gab validate-policy executa primer JSON Schema i després la validació semàntica de Policy.from_file, mentre que el runtime continua carregant directament via Policy.from_file. Per tant, no podem considerar l’esquema l’única font de veritat ni modificar-ne només una banda; una divergència entre totes dues és regressió.

[ecarreras]

@giscebot no entenc què vols dir en aquest comentari #228 (comment) fes que sigui coherent

[pilipilisbot]

Reviewed the schema/validator change and I do not see blockers.

What I checked:

• policy.schema.json rejects unknown fields at the same structural levels that Policy.from_file currently consumes.
• validate-policy runs JSON Schema first and then Policy.from_file, so schema shape errors and runtime semantic checks both stay active.
• Top-level keys used by Policy.from_file match the schema properties.
• Local focused tests in a temporary venv: PYTHONPATH=src /tmp/gab-pr228-venv/bin/python -m pytest -q tests/test_validate_policy.py tests/test_policy.py -> 23 passed.
• Manual CLI checks: valid policy.example.json passes, and an unknown feedbackLearning.surprise field is rejected.

Clarification on the earlier comment: the intended contract is simple: when policy structure changes, update the runtime loader, the JSON Schema, the example/docs, and tests together. The CLI is a deployment/editor guard, while Policy.from_file remains the runtime loader; they must not drift.