feat: allow account and org scope for OPA policies and policy sets

[franciscojuniorharness]

Enable resource_scope account/org/project on governance policy resources so callers can query and manage org- and account-level OPA policies without changing the project default.

Description

Summary

• Enable account and org scope for OPA policy and policy_set via supportedScopes: ["account", "org", "project"], matching connectors/secrets.
• Keep default scope: "project" (no scopeOptional) so existing callers that omit resource_scope are unchanged.
• Document resource_scope in resource descriptions and multi-scope docs; add focused unit tests for query-param injection.

Motivation

OPA policies and policy sets can live at account, org, or project scope in Harness Policy Management (/pm/api/v1/...), but the MCP registry previously declared project-only scope. Callers could not use resource_scope: "org" or "account" without a hard rejection.

Changes

• src/registry/toolsets/governance.ts: add supportedScopes + description hints for policy and policy_set
• Tests: governance request-shape coverage + shared registry multi-scope matrix
• Docs: README, CONTRIBUTING, gemini, policy/policy_set test plans

Usage

harness_list(resource_type="policy", resource_scope="org", org_id="default")
harness_list(resource_type="policy_set", resource_scope="account")
harness_create(resource_type="policy", resource_scope="org", org_id="default", body={...})

## Type of Change
- [ ] Bug fix
- [ ] New feature
- [ ] Refactor
- [ ] Documentation
- [ ] Other

## Checklist
- [ ] `pnpm test` passes
- [ ] `pnpm typecheck` passes
- [ ] `pnpm build` passes
- [ ] `pnpm standards:check` passes (architecture guardrails — see [docs/coding-standards.md](docs/coding-standards.md))
- [ ] `pnpm docs:check` passes (if registry/tool counts changed)

## Coding Standards (registry-driven MCP model)
If this PR adds or changes Harness API coverage:
- [ ] No new `server.registerTool()` calls — only toolset definitions in `src/registry/toolsets/`
- [ ] Toolset registered in `ALL_TOOLSETS` and `ToolsetName` union
- [ ] `operationPolicy` on every new/changed endpoint
- [ ] Shared response extractors from `src/registry/extractors.ts` (no raw passthrough on real endpoints)
- [ ] `identifierFields` and `scope` declared on new resources
- [ ] No `console.log()` in `src/` (stdio JSON-RPC safety)