Enforce Terraform plan policies in Spacelift using a plan policy written in Rego

Steps

1. In the Spacelift UI navigate to Policies > Create Policy and select type `Plan`; plan policies receive the full Terraform plan JSON as input.
2. Write a Rego policy that denies resource destruction beyond a threshold: `deny[sprintf("destroying %d resources", [count])] { count := count([r | r := input.terraform.resource_changes[_]; r.change.actions[_] == "delete"]); count > 5 }`.
3. Spacelift supports both Rego v0 and v1; select the version in the policy editor and use Rego v1 for new policies.
4. Attach the plan policy to a stack by navigating to the stack's Policies tab and linking the created policy.
5. Trigger a proposed run (PR) on the stack; after the plan phase Spacelift evaluates attached plan policies and blocks apply if any `deny` rule fires.
6. Use `warn` rules instead of `deny` for advisory messages; warnings surface in the run UI without blocking apply.