[API] Define Policy, ProviderConnection, Operation, Condition, capability, quota, and cost schemas #19

Outcome

Make control, execution, capability, quota, observation, and cost state explicit before provider code exists.

Scope

• Define control resources, credential references, operation states, condition transitions, provider capabilities, quota checks, and estimate metadata.

Acceptance criteria

• Schemas reject embedded secrets.
• Cost fields include currency, region, source, timestamp, confidence, and an explicit unknown state.
• Operations model pending, waiting, running, succeeded, failed, and cancelled states.

Test and evidence

• Schema fixtures prove secret rejection, condition transitions, and unknown capability/quota/cost behavior.

Dependencies

• Blocked by #17.
• Blocked by #11.
• Blocked by #14.

References

• Architecture overview
• Security model