core: lint custom operators that call private rules or read input directly #101

REFERENCE.md gives three rules for writing a custom operator ("Custom operators"): fail when you can't read the data, read with value_at and $$input rather than input or data.params, and only call value_at, arg and leaf_passed. Nothing enforces them.

Breaking one goes wrong in confusing ways. Calling op_passed or report gives a recursion error that points at ergo.rego, not the user's file. Reading input reads ergo's own names instead of the document, so a check can pass or fail on the wrong data.

Regal's leaked-internal-reference can't help, because custom operators are written in package ergo and that rule only looks at other packages.

Proposal

Ship two Regal custom rules as an optional file next to ergo.rego, for users who run Regal:

• an op_passed rule outside ergo.rego that calls a rule starting with _, or calls op_passed or report
• an op_passed rule outside ergo.rego that reads input or data.params

"Fail when you can't read the data" is too fuzzy to lint, so it stays in the docs.

Things to settle

• Where the file lives and how users load it (regal lint --rules <file>, or copying it into .regal/rules).
• OPA loads every .rego file under the repo, so our own checks would need to ignore it, or it needs to load cleanly without Regal's data.regal.
• Regal's AST format can change between versions, so the rules should be tested against the Regal version CI pins.
• Whether helper rules a custom operator calls (like four_eyes_* in markdown: add a compiler for policies written in markdown #18) should be checked too, not just op_passed bodies.

Done when

• Each rule flags a custom operator that breaks it and passes one that doesn't, in tests.
• REFERENCE.md says how to turn the rules on.
• CI runs those tests.