feat: Implement Trust Broker (SPIFFE/SPIRE + OPA)

[dcplatforms]

Overview

Implement the Trust Broker — central authorization mediator for all inter-agent communication. Every message between agents MUST pass through this component.

Spec: specs/security/trust-broker.yaml | Architecture: docs/ARCHITECTURE.md §5.2

Implementation

• TrustBroker class in src/security/trust_broker/
• Integrate pyspiffe for JWT-SVID verification
• OPA client for policy evaluation (deny-by-default)
• Audit ledger writer (append-only, every decision logged)
• Fail-closed: if SPIRE or OPA unreachable → deny ALL requests

Tests Required

• Expired SVID → deny + log
• Wrong trust domain → deny + log
• OPA unreachable → deny all (fail closed)
• Valid SVID + allowed action → approve + log
• Agent impersonation attempt → detect + alert operator