Add JSON Schema validation for Sentinel policy YAML

[sunilgentyala]

Problem

load_policy() in scripts/gsh-sentinel-deploy.py (line ~120) parses configs/sentinel-policy-default.yaml with plain yaml.safe_load and no schema validation. A malformed or incomplete policy file (typo'd key, wrong type, missing threshold) silently falls back to DEFAULT_POLICY or fails deep inside a hunt's threshold logic instead of failing fast with a clear message.

Expected files

• schemas/sentinel-policy.schema.json — JSON Schema describing the policy structure (global, sentinel, hunt_001–hunt_004, ztlv sections as seen in configs/sentinel-policy-default.yaml).
• Update load_policy() in scripts/gsh-sentinel-deploy.py to validate against the schema (e.g. via jsonschema, added as an optional dependency in requirements.txt with a stdlib fallback that does basic key/type checks if jsonschema isn't installed, consistent with this repo's "stdlib fallback" pattern).
• A gsh policy validate <path> style helper (can be a small function/CLI flag on the existing script; a full gsh CLI package is out of scope for this issue).

Acceptance criteria

• Loading configs/sentinel-policy-default.yaml passes validation with no warnings.
• Loading a policy file missing a required key, or with a threshold field set to the wrong type (e.g. a string where a number is expected), fails with a specific error message naming the field and the file, not a generic exception or silent fallback.
• Works with jsonschema uninstalled (stdlib fallback) and installed.

Example

$ python scripts/gsh-sentinel-deploy.py --policy configs/bad-policy.yaml --target x --mode passive
ERROR: Invalid policy 'configs/bad-policy.yaml': hunt_001.loop_threshold must be a number, got str

Test requirements

• Unit test with a valid policy file (should pass).
• Unit test with 2-3 invalid policy files (missing key, wrong type, unknown top-level section) asserting the specific error raised.