[Draft] Bootstrap policy and infrastructure verification checks

[BASIC-BIT]

Problem

#51 calls for policy and infrastructure verification as part of the layered trust model, but VRDex does not yet have a concrete first slice for structural checks and infra/deployment validation.

Baseline lint/tests and browser checks are useful, but they do not protect against the kinds of regressions that tend to show up in scripts, config, infrastructure code, and deployment automation.

Scope

• choose the first practical structural or policy checks worth enforcing in this repo
• add an initial policy/static-validation pass for code, scripts, or config where structural rules matter
• add an initial verification path for infrastructure or deployment automation that exists in-repo
• make the selected checks runnable in local or CI workflows as appropriate
• document what these checks protect, where they apply, and how contributors should use them
• keep the first slice intentionally small so we do not overbuild before the app and infra layers are fully in place

Non-goals

• implementing a full compliance or security program immediately
• requiring heavyweight infrastructure validation before infrastructure code exists
• covering every possible AST, policy, secret-scanning, or cloud-validation tool in one pass
• turning early repo bootstrapping into a giant platform-engineering detour

Acceptance criteria

• the repo has a documented first-pass policy or structural validation layer
• the repo has an initial infrastructure/deployment validation path for the infra code that exists
• the selected checks are wired into the appropriate automation path when practical
• contributors can tell what these checks are for and when to expand them later
• the issue is clearly positioned as a concrete follow-on under #51, not the complete long-term verification posture

Likely docs to update

• README.md
• docs/agentic/contributor-workflow.md
• docs/agentic/definition-of-done.md
• docs/planning/engineering-strategy.md
• any future infra/deployment setup doc created during implementation

Soft dependencies

• #51 Define layered verification loops and human validation package expectations
• #59 Bootstrap repository verification tooling and developer guardrails
• #56 Bootstrap initial Vercel deployment path
• #57 Bootstrap initial AWS service baseline

Soft dependents

• future infrastructure-as-code and deployment-hardening work
• future policy-check and repo-guardrail expansion work
• later billing, auth, and permissions work that benefits from stronger structural checks