docs(rfc): add gateway interceptors RFC

[drew]

Important

DRAFT NOT READY FOR COMMENTS

Summary

Adds RFC 0006 for Gateway Interceptors, a proposed gateway extension system for operation-level business logic around OpenShell API workflows.

Related to #1919

Changes

• Adds the Gateway Interceptors RFC with operation phases, service-declared bindings, selection and ordering, failure policy, transport, observability, and security model.
• Adds a non-normative policy governance worked example covering policy authority, policy verification, driver config validation, quotas, and sandbox name prefixes.
• Clarifies motivation, gateway-state boundaries, binding terminology, and request lifecycle flow for readers without prior context.

Testing

• mise run markdown:lint passes
• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Attempted mise run pre-commit. Markdown lint passed, but the aggregate task failed in local environment setup: python:proto could not find grpc_tools.protoc; Rust lint also failed while building native dependencies due missing z3.h and an aws-lc-sys compile error with /opt/homebrew/bin/gcc-15 against macOS SDK headers.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.