Run self-protection checks through native OPA

[fraware]

The deterministic evaluator already implements the self-protection semantics and normalized evidence path.

Add a pinned native OPA execution path, compare it with the deterministic evaluator on pass, fail, and unknown fixtures, and fail closed when OPA is unavailable. Record which path produced the evidence.

[fraware]

Implementation progress:

• Added ovk/adapters/opa/self_protection.py
• Added adapter package initialization
• Added failing and passing fixtures in examples/no_agent_self_approval/
• Added scripts/run_self_protection_demo.py
• Added tests/test_opa_self_protection.py
• Added docs/FIRST_DEMO.md

The current path uses a deterministic Python evaluator for the first OPA-style policy so the demo can run in CI without requiring the OPA binary. Next step: connect the same semantics to actual OPA CLI execution.

[fraware]

Re-scoped after auditing main: normalized self-protection evidence already ships through the deterministic evaluator. The remaining gap is native OPA execution with explicit parity and provenance.