feat(go): native Go policy evaluator for Kubernetes SSI targeting

[iamluc]

Description

Adds a self-contained, dependency-free Go policy evaluator to this repo
(go/policies), mirroring the semantics of the C engine: tri-state
TRUE/FALSE/ABSTAIN over an AND/OR/NOT tree of leaf evaluators, plus a dd-wls
JSON decoder (the JSON projection of the FlatBuffers policy schema).

This is the Go evaluator the Cluster Agent will use to target Kubernetes
Single Step Instrumentation (SSI) workloads natively (no CGO at runtime).

To make "shares the same test suite" real, this PR also adds a cross-engine
conformance suite: a single go test runs a shared corpus through both the
Go engine and the real C engine (libpolicies, linked via cgo) in one
process and asserts they agree. The K8s string evaluators are added to the
schema (and to the C engine's public enum) so policies can target
pods/namespaces on both sides.

Scope is deliberately limited to the engine + schema + conformance. The
target -> policy compiler and the Cluster Agent wiring (RC subscription,
mutator) stay in datadog-agent and land in follow-up PRs.

What's in here

Go engine (go/policies)

• model + node constructors, tri-state evaluator with C-parity semantics
  (boolean folding, signed/unsigned numeric leaves, key=value/key= label
  leaves, depth limit mirroring PLCS_MAX_EVAL_DEPTH);
• dd-wls JSON decoder (ParsePolicies);
• Evaluate (rule tree -> tri-state Result) and Decide (folds the outcomes
  of all matching policies in document order, matching the C engine's
  no-first-match-short-circuit behavior — not first-match-wins).

Cross-engine conformance

• go/policies/testdata/conformance/vectors.json: shared corpus (boolean
  composition, string comparators, labels, numeric, ABSTAIN propagation).
• conformance_test.go: portable Go-only runner (no cgo, runs everywhere).
• conformance_cgo.go + conformance_cross_test.go: cgo bridge to the real C
  engine plus host evaluators that mirror what the Go engine bakes in (constant
  ALWAYS_* leaves, the key=value/key= label evaluator, and numeric
  evaluators that abstain on an unset source). Each vector is serialized to a
  FlatBuffers NodeTypeWrapper buffer and run through libpolicies; the result
  must equal both the Go engine's result and the expected value. Gated behind
  the conformance_cgo build tag, so the default CGO_ENABLED=0 builds are
  unaffected. Run with make -C go conformance-cross.

Schema + C engine parity

• fbs-schema/evaluator_ids.fbs: NAMESPACE_NAME, NAMESPACE_LABEL,
  POD_LABEL, POD_ANNOTATION (append-only); regenerated Go schema.
• c/include/dd/policies/evaluator_types.h: extend the public
  string-evaluator enum with the same 4 K8s ids so the engine reaches schema
  parity (the _Static_assert against the schema count now matches);
  regenerate evaluator_ids_reader.h.

CI

• .github/workflows/dev.yml: new conformance-cross-engine job running the
  cross-engine suite in the build container on Linux amd64 + arm64.

Related Issue

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactor / cleanup
• CI / tooling
• Documentation

Checklist

• Documentation updated if needed (package doc)
• Tests added or updated
• No unintended breaking changes (schema additions are append-only)

How Has This Been Tested?

In the build container:

• CGO_ENABLED=0 go vet ./policies/... and the Go-only conformance test are
  green; the cgo-gated file is correctly excluded from default builds.
• make -C go conformance-cross: all corpus vectors pass through both the
  Go engine and the real C engine in one process (semantic parity with
  libpolicies proven on the same inputs, not just ported expectations).
• make -C c test: the full C unit-test suite still passes after the public
  enum extension.
• TestDecoderIdentifiersMatchSchema pins every identifier the decoder accepts
  to the .fbs source shared with the C engine, so the two cannot drift apart.

Additional Notes

• Numeric "unset" semantics: the default C numeric evaluator compares a
  missing fact against the NOT_SET sentinel (FALSE), whereas the Go model
  abstains. Rather than change the engine (and break existing C tests), the
  conformance host registers numeric evaluators that abstain on NOT_SET,
  reproducing the Go semantics at the host level — where the generic C engine
  expects such decisions to live.
• JSON schema diff: policy.schema.json was regenerated with
  flatc 25.2.10; the committed file lagged the .fbs, so the regen also
  resyncs it in addition to the 4 new K8s ids.
• Follow-ups (in datadog-agent): target -> policy compiler + golden
  tests; Cluster Agent wiring (facts, mutator, RC apm-wls subscription) with a
  differential test vs the current TargetMutator.

[datadog-datadog-prod-us1]

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 21.71%

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 37fc60f | Docs | Datadog PR Page | Give us feedback!}