feat(P1): kyverno-json engine core + PolicyEngine protocol (REQ-291..294, 308, 309)

core/policy_engine.py: PolicyEngine Protocol (PEP 544, runtime_checkable)
+ PolicyEngineRegistry (selects from config.json.policy.engine) + NullEngine
fallback (NULL_ENGINE_INACTIVE when policy key absent).

adapters/kyverno-json/: KyvernoJsonEngine — shells to , translates
native output → list[dict] PCR records (engine: "kyverno", ruleId KJ_ prefix,
severity via nova.cloudinit.dev/severity annotation, default info).
is_configured() guards on  → KJ_ENGINE_NOT_CONFIGURED SKIPPED PCR
(distinct from NullEngine). Defensive parsing (malformed → error PCR).

config.json: new  object {engine: kyverno-json, policy_root}.

scripts/install-kyverno-json.sh: go install kj@latest (D-115).
CI (.gitea + .github): install Go + kj for policy-engine tests (best-effort;
tests skip when kj absent).

tests: 24 pass, 2 skip (kj not installed). 132 existing tests unchanged.
NullEngine satisfies PolicyEngine Protocol (G-Q8a — proves swap boundary).

---ci---
project: acdl
phase: 1
milestone: v1.25
status: execute
phase_role: execution
requirements:
  covered: [REQ-291, REQ-292, REQ-293, REQ-294, REQ-308, REQ-309]
  partial: []
---/ci---

.github/workflows/ci.yml

@@ -63,6 +63,21 @@ jobs:
       - name: Install test dependencies
         run: pip install -r requirements-test.txt
 
+      - name: Install kyverno-json (kj) for policy-engine tests
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+          cache: false
+
+      - name: Install kj binary
+        run: |
+          # v1.25: kyverno-json is the primary policy engine. Tests that
+          # require kj skip when absent, so this is best-effort (the suite
+          # passes with or without kj).
+          go install github.com/kyverno/kyverno-json/cmd/kj@latest && \
+            echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH" || \
+            echo "kj install failed; policy-engine tests will skip"
+
       - name: Run pytest
         run: python3 -m pytest tests/ -v --tb=short