Introduce kosli evaluate

[tooky]

Why: Customers are duplicating attestation types to work around the lack of evaluation logic — creating separate types per environment just to encode different pass/fail rules. Three independent customers (JB, Deutsche Bank, Norsk Tipping) have hit this, and two more (Blackstone, NatWest) are building toward it. This is the most consistent product gap in our pipeline.

Objective: Add kosli evaluate — a CLI command that applies a Rego policy to trail data and returns a structured pass/fail decision. This separates what you collect (attestation type) from how you judge it (evaluation), and is the first step toward controls as a first-class product concept.

How this was built

This PR is also a demonstration of elephant carpaccio + TDD with Claude Code. The entire feature was built as a conversation — 48 commits, each one a single red-green-refactor step. Slices were kept thin enough to review independently, and the commit list reads bottom-to-top as a narrative of how the feature grew. Later commits came from reviewing the branch against Beck's Rules of Simple Design. The branch is intentionally unrebased so you can follow the progression.

Capabilities

• kosli evaluate trail <name> — single trail against a Rego policy
• kosli evaluate trails <name>... — multiple trails in one policy call
• --output json|table — structured audit output or human-readable (default)
• --show-input — include policy input in JSON output for debugging
• --attestations — filter which attestations reach the policy (plain name for trail-level, artifact.name for artifact-level)
• Exit code 0/1 reflects the policy decision — designed for CI/CD gates

Example

Validate all PRs are approved:

package policy

import rego.v1

default allow = false

violations contains msg if {
    some trail in input.trails
    some pr in trail.compliance_status.attestations_statuses["pull-request"].pull_requests
    count(pr.approvers) == 0
    msg := sprintf("trail '%v': pull-request %v has no approvers", [trail.name, pr.url])
}

allow if {
    count(violations) == 0
}

Kosli Server:

$ kosli evaluate trails \
  --policy pr-approved.rego \
  --org kosli \
  --flow server \
  --attestations pull-request \
  c643b06bf2efaa8f35d4da54c9e34a34a28bd251 \
  bd8254c58d20826df7248772cedf523f715516b6 \
  012cb304aab50bc4a3cc96fba7840ff29ea4d19e \
  a49a603c04b73c58d18909aace2f13e98892089f \
  9373bda52a51550b8ecb2236ed94cb88aa6e3a98
RESULT:  ALLOWED

CyberDojo Dashboard:

$ kosli evaluate trails \
  --policy tmp/pr-approved.rego \
  --org cyber-dojo \
  --flow dashboard-ci \
  9978a1ca82c273a68afaa85fc37dd60d1e394f84 \
  b334d371eb85c9a5c811776de1b65fb80b52d952 \
  5abd63aa1d64af7be5b5900af974dc73ae425bd6 \
  cb3ec71f5ce1103779009abaf4e8f8a3ed97d813
RESULT:      DENIED
VIOLATIONS:  trail '5abd63aa1d64af7be5b5900af974dc73ae425bd6': pull-request https://github.com/cyber-dojo/dashboard/pull/342 has no approvers
             trail '9978a1ca82c273a68afaa85fc37dd60d1e394f84': pull-request https://github.com/cyber-dojo/dashboard/pull/344 has no approvers
             trail 'b334d371eb85c9a5c811776de1b65fb80b52d952': pull-request https://github.com/cyber-dojo/dashboard/pull/343 has no approvers
             trail 'cb3ec71f5ce1103779009abaf4e8f8a3ed97d813': pull-request https://github.com/cyber-dojo/dashboard/pull/341 has no approvers
Error: policy denied: [trail '5abd63aa1d64af7be5b5900af974dc73ae425bd6': pull-request https://github.com/cyber-dojo/dashboard/pull/342 has no approvers trail '9978a1ca82c273a68afaa85fc37dd60d1e394f84': pull-request https://github.com/cyber-dojo/dashboard/pull/344 has no approvers trail 'b334d371eb85c9a5c811776de1b65fb80b52d952': pull-request https://github.com/cyber-dojo/dashboard/pull/343 has no approvers trail 'cb3ec71f5ce1103779009abaf4e8f8a3ed97d813': pull-request https://github.com/cyber-dojo/dashboard/pull/341 has no approvers]

Architecture

• internal/evaluate/ — OPA Rego engine + trail data transforms (array-to-map, rehydration from detail API, filtering)
• cmd/kosli/evaluateHelpers.go — shared options, flag registration, fetch+enrich pipeline, output dispatch
• cmd/kosli/evaluateTrail.go / evaluateTrails.go — thin command wrappers

Also included

• Upgraded golang.org/x/net to v0.51.0 for CVE-2026-27141