Add configurable project quality-gate policies

[johannesjo]

Context

After merge readiness and structured findings are available, projects should be able to decide which signals are informational and which must pass before merging.

GitHub Code Quality uses ruleset thresholds and supports gradual evaluation before enforcement:
https://docs.github.com/en/code-security/how-tos/maintain-quality-code/set-pr-thresholds

Dependencies

• Advisory “Ready to merge?” summary
• Structured quality findings
• Coverage deltas for coverage-based rules

Scope

• Add per-project policy modes: Off, Advisory, and Block merge.
• Allow policy rules for:
  • required structured verification
  • PR checks
  • maximum unresolved finding severity
  • minimum coverage and maximum coverage regression
• Default existing projects to Advisory.
• Show exactly which policy rule failed in the merge dialog.
• Provide an explicit, auditable override path where policy allows overrides.

Non-goals

• Organization-level administration
• Cloud policy synchronization
• Opaque aggregate quality scores
• Letting subjective AI-only notes block merges by default

Acceptance criteria

• Existing projects retain current merge behavior after upgrade.
• Advisory mode never disables merge but clearly reports failures.
• Blocking mode disables merge only for configured, evaluated rules.
• Missing/unavailable signals have an explicit configurable treatment.
• Policy evaluation is deterministic and unit tested.
• Settings and merge UI are keyboard accessible and explain overrides.