docs(rfc): add Policy Provider subsystem (RFC 0005)

[dvavili]

Summary

Proposes a first-class, pluggable Policy Provider subsystem on the gateway, following the same driver model OpenShell already uses for compute, credentials, and identity (RFC 0001): a type = selector with two drivers — local (today's built-in store-backed path, the default) and external (policy sourced from a separate provider process over a gRPC contract). The change is additive and opt-in; the built-in path and all downstream enforcement (supervisor, proxy/OPA, Landlock/seccomp) are unchanged. This enables deployments where the policy authority and the gateway are different parties — e.g. enterprise policy signed off-host in a separate trust domain, verified by the gateway, and independently auditable.

Related Issue

Scoping issue: #1713

Changes

• Add rfc/0005-policy-provider/README.md (state: review).
• RFC number 0005 is also claimed by open PRs RFC 0005: Platform-managed Kubernetes sandboxes #1680 and docs(rfc): dpu vm driver extension #1479 — happy to renumber per the RFC process at merge time.

Testing

Docs-only RFC; no code changes.

• mise run markdown:lint passes (0 errors)
• Unit tests added/updated — N/A
• E2E tests added/updated (if applicable) — N/A

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable) — N/A for an RFC; folds into architecture/ when implemented

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your interest in contributing to OpenShell, @dvavili.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}

[dvavili]

I have read the DCO document and I hereby sign the DCO.

[dvavili]

recheck