docs(opa): enhance OPA/Conftest reference with strict check, pre-commit, bundle packaging, and conftest pull

[nitinjain999]

Summary

Enhances references/opa.md and commands/opa.md with seven documentation improvements aligned to OPA v1.x and Conftest v0.50+ workflows.

Changes

references/opa.md

• Pipeline step 1.5 — opa check --strict <dir> after format check, regal fix <dir> before regal lint, with rationale for each
• Troubleshooting table — new row for opa eval tracing: basic invocation and --explain full variant for rule evaluation debugging
• Pre-commit Integration section — full .pre-commit-config.yaml using anderseknert/pre-commit-opa@v1.5.1 with 6 hooks (opa-fmt, opa-check, opa-test, conftest-fmt, conftest-test, conftest-verify), monorepo scoping via files:, hook execution order, and install command
• Bundle Packaging section — opa build with --entrypoint and --signing-key, ORAS OCI push to GHCR, opa inspect to verify, versioning convention
• Pulling shared policy bundles section — conftest pull oci://ghcr.io/... and conftest pull git::https://..., policy.yaml for pinned sources, conftest test --update, .gitignore entry for .cache/conftest/

commands/opa.md

• Validate mode — inserted step 3 (opa check --strict <dir>) and step 4 (regal fix <dir>) before lint; renumbered subsequent steps
• Debug mode — inserted step 3 with opa eval tracing (basic + --explain full variants); renumbered old steps 3→4 and 4→5

Validation

1. Review the diff in both changed files
2. Verify pipeline order: conftest fmt --check → opa check --strict → regal fix → regal lint → conftest verify → conftest test
3. Install pre-commit hooks in a test repo: pre-commit install && pre-commit run --all-files
4. Run opa build ./policies --entrypoint terraform/iam -o bundle.tar.gz to verify bundle packaging syntax

Rollback

Docs-only change — no runtime or infrastructure impact. Close or revert the PR to undo.