Add programmable policy engine for network governance

Replace the three separate governance mechanisms (AllowedPorts, ManagedEngine,
NetworkRules) with a unified policy engine powered by expr-lang/expr expressions.

Networks get a policy document with ordered rules evaluated against protocol
events (connect, dial, datagram, cycle, join, leave). Gate events produce
allow/deny verdicts; action events fire score, tag, prune, fill, evict, and
webhook directives.

- pkg/policy: pure library — parse, validate, compile, evaluate policies
- pkg/daemon: PolicyRunner per network with peer state, cycle timer, persistence
- pkg/registry: ExprPolicy field on NetworkInfo, set/get handlers (admin-gated)
- pkg/driver: PolicyGet/PolicySet IPC methods
- pilotctl: policy get/set/validate/test CLI commands
- Backward compat: RulesToPolicy and AllowedPortsToPolicy bridges
- 71 new tests across policy, daemon, registry, and integration packages

Author: teovl

cmd/pilotctl/main.go

@@ -3,6 +3,7 @@ module github.com/TeoSlayer/pilotprotocol
 go 1.25.3
 
 require (
+	github.com/expr-lang/expr v1.17.8
 	github.com/stripe/stripe-go/v81 v81.4.0
 	modernc.org/sqlite v1.48.0
 )

go.mod

@@ -2,6 +2,8 @@ github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/expr-lang/expr v1.17.8 h1:W1loDTT+0PQf5YteHSTpju2qfUfNoBt4yw9+wOEU9VM=
+github.com/expr-lang/expr v1.17.8/go.mod h1:8/vRC7+7HBzESEqt5kKpYXxrxkr31SaO8r40VO/1IT4=
 github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
 github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=