Governance policy integration: custom rules and severity overrides

[Shreyan1]

Summary

Implements governance policy integration as requested in #68. Organizations can now define custom security rules, severity overrides, and agent governance checks via a .github/governance-policy.yaml file.

• Adds governance-policy input to the action (defaults to .github/governance-policy.yaml)
• Loads and validates governance policy YAML with severity overrides, custom rules, and agent governance settings
• Passes governance context to the security audit prompt so organizational rules are factored into analysis
• Applies severity overrides post-analysis (pattern + context matching against findings)
• Runs custom regex-based rules against the PR diff with file path glob filtering
• Adds governance_summary to the output JSON with policy metadata and stats

Test plan

• 36 new unit tests covering policy loading, validation, severity overrides, custom rule matching, path filtering, prompt generation, and integration with main audit flow
• Full test suite passes (209/209 tests, zero regressions)
• Manual validation: create a sample .github/governance-policy.yaml in a test repo and run the action

Closes #68