[codex] implement policy-pack v0.5

[josediegorobles]

Summary

Adds policy-pack, a local, explainable Bitcoin policy/risk evidence report for directories containing descriptor, PSBT, transaction, policy notes, and optional metadata.

What changed

• Added btc-risk-lab policy-pack --input DIR --format json|markdown [--output FILE].
• Added schema 0.5 PolicyPackReport with artifacts detected, evidence document summaries, per-artifact summaries, consolidated findings, warnings, missing evidence, review questions, and limitations.
• Reused the existing review-pack layer and the descriptor, PSBT, transaction, and script analyzers instead of duplicating parsing logic.
• Added Markdown/YAML/JSON policy note evidence summaries and optional metadata summaries.
• Added realistic fixtures under tests/fixtures/policy-packs/ plus CLI and unit tests.
• Added public sample report at docs/policy-pack-sample.md.
• Updated README, ROADMAP, CHANGELOG, and bumped version metadata to 0.5.0.

Security boundaries

policy-pack is local-only by default. It does not sign, create wallets, handle keys, broadcast transactions, or make network calls. The report is evidence for human review, not consensus/policy validity, wallet ownership proof, or formal descriptor/PSBT/transaction equivalence.

Validation

• cargo fmt --all --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-features
• cargo run --quiet -- policy-pack --input tests/fixtures/policy-packs/multisig-timelock --format markdown

Why this matters

This strengthens the OpenSats-facing story for btc-risk-lab: reproducible, offline, explainable Bitcoin review reports that bridge raw protocol artifacts and the evidence custodians, auditors, educators, and technical teams need to reason about risk without relying on closed-source scoring.

[Copilot]

Pull request overview

This PR introduces a new policy-pack feature to generate local, explainable custody/audit “evidence pack” reports by reusing the existing review-pack analyzers and layering in policy-notes/metadata evidence summaries.

Changes:

• Added btc-risk-lab policy-pack --input DIR --format json|markdown [--output FILE] and a new schema 0.5 PolicyPackReport.
• Implemented policy-pack analysis + Markdown/JSON rendering, including evidence document summaries, findings, warnings, missing evidence, review questions, and limitations.
• Added fixtures, CLI/unit tests, and documentation/sample output; bumped crate version to 0.5.0.

Reviewed changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/fixtures/policy-packs/multisig-timelock/tx.json	Adds a transaction fixture used by policy-pack tests/sample output.
tests/fixtures/policy-packs/multisig-timelock/script.txt	Adds a script fixture to drive timelock signal detection in reports.
tests/fixtures/policy-packs/multisig-timelock/psbt.base64	Adds a PSBT fixture for policy-pack analysis.
tests/fixtures/policy-packs/multisig-timelock/policy.yaml	Adds YAML policy notes fixture for evidence-document summarization.
tests/fixtures/policy-packs/multisig-timelock/policy.md	Adds Markdown policy notes fixture for evidence-document summarization.
tests/fixtures/policy-packs/multisig-timelock/metadata.json	Adds optional metadata fixture consumed by policy-pack.
tests/fixtures/policy-packs/multisig-timelock/descriptor.txt	Adds a descriptor fixture to exercise multisig/weight findings.
tests/fixtures/policy-packs/missing-policy-notes/psbt.base64	Adds fixture to validate missing policy notes behavior.
tests/cli.rs	Adds CLI regression tests for policy-pack JSON and Markdown-to-file output.
src/report/mod.rs	Adds policy-pack rendering entrypoint + Markdown renderer for PolicyPackReport.
src/policy_pack.rs	Implements PolicyPackReport schema 0.5 and policy-pack analysis logic (evidence docs + findings/questions/limitations).
src/main.rs	Adds policy-pack CLI subcommand wired into analysis + rendering + output handling.
src/lib.rs	Exposes policy_pack module from the library crate.
ROADMAP.md	Documents policy-pack as completed MVP and clarifies non-goals.
README.md	Documents policy-pack command usage, supported evidence files, and security/limitations.
docs/policy-pack-sample.md	Adds a sample policy-pack Markdown report for users to reference.
CHANGELOG.md	Adds v0.5.0 release notes for the policy-pack feature set.
Cargo.toml	Bumps crate version to 0.5.0.
Cargo.lock	Updates lockfile to reflect the new crate version.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.