refactor genertor: integrate domain isolation, utilize personas.yaml for test generation

[tyler-pf9]

Adds domain isolation support to the rego policy generator and overhauls the generation pipeline to produce policies from service containers instead of upstream PyPI packages so we do not miss generating relevant addon attributes.

Changes:

• Inject same_domain domain isolation gate into ownership and admin rule bodies for neutron, nova,
  cinder, glance, keystone does not require as it has domain isolation already.
• Rename lib packages to {service}_lib to prevent cross-service collisions
• Fix regex.match to strip oslo ~ prefix, emit valid Rego (before regex was commented out and skipped for generation)
• Remove http.send calls (expect pre-fetched target data instead)
• Add persona-based test generation with full credential shapes and denial tests
• Generation script: per-service image builds via .env configuration
• Makefile: make generate chains build, generation, and opa fmt
• Policy overrides and persona definitions added to oslo_policies/

All tests pass OPA unit tests, engine needs regex support for create_port/device_owner.rego and update_port/device_owner.rego which were not getting generated before.