Add Codewith remote build policy

[andrei-hasna]

Summary

• add Codewith provider policy for BuildBuddy secret handling
• cover the rendered policy overlay in source tests

Verification

• git fetch origin --prune
• git worktree prune --expire now --verbose
• git worktree add /home/hasna/Workspace/hasna/opensource/open-identities-codewith-remote-build-policy-20260711 feat/codewith-remote-build-policy
• git diff --name-status origin/main..HEAD shows only src/global-agent-rules.ts and src/index.test.ts
• git diff --check origin/main..HEAD
• secret-pattern scan over origin/main..HEAD: allowed matches only for BUILDBUDDY_API_KEY and the vault key path name; no credential values
• Co-Authored-By scan over origin/main..HEAD commits: no matches

No generated CODEWITH.md was changed. No heavy local Rust/Bazel builds or tests were run.