Batch-evaluate OPA policy against input files

Previous value: -"Policy and data files or directories, loaded the way `opa eval --data` loads them: a `.rego` file as a module, a JSON or YAML file merged into the data root, a directory recursively, so every JSON and YAML file in it is data. A bundle among them (an archive, or a directory holding a `.manifest`) is loaded as a bundle instead; bundles and plain paths cannot be mixed. To load a directory as a bundle, reading only its data.json, pass it as `bundle`. Mutually exclusive with `bundle`."New value: +"Policy and data files or directories, loaded the way `opa eval --data` loads them: a `.rego` file as a module, a JSON or YAML file merged into the data root, a directory recursively, so every JSON and YAML file in it is data and must parse. One difference: a bundle archive (`.tar.gz`) inside a directory is not loaded, and `warnings` names it. A bundle given here directly (an archive, or a directory holding a `.manifest`) is loaded as a bundle; bundles and plain paths cannot be mixed. To load a directory as a bundle, reading only its `.rego` files and those named data.json, data.yaml or data.yml, pass it as `bundle`. Mutually exclusive with `bundle`."

Previous value: -"Read the policy as Rego v0 (`--v0-compatible`), the syntax OPA used before 1.0: rules without `if`, partial sets as `deny[msg] { ... }`. Needed for a policy that has not been migrated, which OPA 1.x otherwise refuses to load."New value: +"Read the policy as Rego v0 (`--v0-compatible`), the syntax OPA used before 1.0: rules without `if`, partial sets as `deny[msg] { ... }`. Needed for a policy that has not been migrated, which OPA 1.x otherwise refuses to load. Where the tool also takes a query, the query is read as v0 too, with the future keywords imported so `in`, `every` and `some x in` still work in it."

Previous value: -"Policy and/or data file or directory paths, each loaded as an OPA bundle root (opa exec loads policy only via bundles). Mutually exclusive with `bundle`."New value: +"Policy and data files or directories, loaded the way `opa eval --data` loads them: a `.rego` file as a module, a JSON or YAML file merged into the data root, a directory recursively, so every JSON and YAML file in it is data. A bundle among them (an archive, or a directory holding a `.manifest`) is loaded as a bundle instead; bundles and plain paths cannot be mixed. To load a directory as a bundle, reading only its data.json, pass it as `bundle`. Mutually exclusive with `bundle`."

Added value: +{
+  "description": "Read the policy as Rego v0 (`--v0-compatible`), the syntax OPA used before 1.0: rules without `if`, partial sets as `deny[msg] { ... }`. Needed for a policy that has not been migrated, which OPA 1.x otherwise refuses to load.",
+  "type": "boolean"
+}

Previous value: -"The policy entrypoint to evaluate for each input, e.g. `\"data.authz.allow\"` or `\"data.policy.violations\"`. Must be a fully-qualified Rego reference."New value: +"The policy entrypoint to evaluate for each input, e.g. `\"authz/allow\"`. `opa exec` names a decision by slash-separated path with no `data.` prefix; the Rego reference forms (`data.authz.allow`, `authz.allow`) are accepted here and converted, because passing one straight through leaves every file undefined."

Previous value: -"Policy and/or data file or directory paths to load. Mutually exclusive with `bundle`."New value: +"Policy and/or data file or directory paths, each loaded as an OPA bundle root (opa exec loads policy only via bundles). Mutually exclusive with `bundle`."

Added value: +{
+  "description": "CI gate: report `failed: true` when any decision is undefined or errors. Mutually exclusive with `failDefined` and `failNonEmpty`.",
+  "type": "boolean"
+}

Added value: +{
+  "description": "CI gate: report `failed: true` when any decision is defined or errors. Use when a defined result means a violation. Mutually exclusive with `fail` and `failNonEmpty`.",
+  "type": "boolean"
+}

Added value: +{
+  "description": "CI gate: report `failed: true` when any decision result is non-empty or errors. Mutually exclusive with `fail` and `failDefined`.",
+  "type": "boolean"
+}

Added value: +{
+  "description": "Per-exec evaluation timeout as a Go duration, e.g. `\"30s\"` or `\"5m\"`. Still bounded by the server subprocess timeout (OPA_MCP_TIMEOUT_MS).",
+  "type": "string"
+}

Added value: +{
+  "description": "Opt in to OPA v1.0-compatible behaviors (`--v1-compatible`).",
+  "type": "boolean"
+}