feat: add segregation of duties schema, types, and spec

[patel-lyzr]

Summary

Adds the segregation_of_duties subsection to the gitagent compliance schema — a new spec-level concept for enforcing that no single agent controls a critical process end-to-end.

• JSON Schema (agent-yaml.schema.json): Full segregation_of_duties_config definition with roles (id, description, permissions), conflicts (2-tuples), assignments (agent→roles mapping), isolation (state/credentials enums), handoffs (action + required_roles + approval), and enforcement (strict/advisory)
• TypeScript types (loader.ts): segregation_of_duties added to ComplianceConfig interface
• Specification (SPECIFICATION.md): DUTIES.md convention (root + per-agent levels), SOD YAML documentation, validation rule Welcome to gitagent — introduce yourself and your use case #8, regulatory reference table (FINOS, SOC 2, SR 11-7, FINRA 3110)

Context

Inspired by Salient AI's purpose-built agent architecture (each agent scoped to one duty in the lending lifecycle) and the FINOS AI Governance Framework's multi-agent isolation controls.

Closes #10 (part 1 of 4)

Test plan

• npm run build passes cleanly
• Review schema validates correctly against example agents
• Spec documentation is clear and complete

PR Stack

This is PR 1 of 4 for the SOD feature:

1. Spec + Schema + Types (this PR)
2. CLI support (validate, audit, init)
3. Adapter support (system-prompt, claude-code)
4. Examples + docs (examples/full/, README)

🤖 Generated with Claude Code

[shreyas-lyzr]

Nice work splitting this into a proper PR stack — much easier to review.

This PR (spec + schema + types) looks solid:

• Schema design is clean — roles, conflicts, assignments, isolation, handoffs, enforcement all make sense as separate concerns
• The permissions enum (create, submit, review, approve, reject, execute, audit, report) covers the maker-checker-executor-auditor pattern well
• DUTIES.md at two levels (root policy + per-agent declaration) is a smart design choice — mirrors how RULES.md works
• Validation rule #8 in the spec is well-defined with clear constraints
• Regulatory reference table (FINOS, SOC 2, SR 11-7, FINRA 3110) adds credibility

One minor thing: the DUTIES.md line in the directory structure tree has extra spaces vs the other entries — cosmetic but worth fixing:

├── DUTIES.md                 # (3 extra spaces vs other lines)

Approving — this is ready to merge. The rest of the stack depends on it so let's get this in.