New policy

Add a governance document. Map it to CSF with a framework ref (e.g. NIST CSF GV.PO-01) so it counts toward compliance coverage.