feat(cloud): add targeted task governance foundation

packages/cloud-platform/cloud/repository.py

@@ -15,6 +15,7 @@ if TYPE_CHECKING:
         UserAccount,
         UserSession,
     )
+    from cloud.governance import HostGovernancePolicy, UserSubmissionPolicy
 
 
 AttemptStatus = Literal["assigned", "dispatched", "done", "failed", "expired"]
@@ -283,6 +284,30 @@ class CloudRepository(Protocol):
 
     def cleanup_auth_state(self, *, now: datetime, limit: int) -> int: ...
 
+    def get_user_submission_policy(self, user_id: str) -> UserSubmissionPolicy | None: ...
+
+    def upsert_user_submission_policy(
+        self,
+        *,
+        user_id: str,
+        submission_enabled: bool,
+        allowed_host_ids: tuple[str, ...] | None,
+        allowed_device_targets: tuple[tuple[str, str], ...] | None,
+        updated_at: datetime,
+    ) -> UserSubmissionPolicy: ...
+
+    def get_host_governance_policy(self, host_id: str) -> HostGovernancePolicy | None: ...
+
+    def upsert_host_governance_policy(
+        self,
+        *,
+        host_id: str,
+        self_submission_enabled: bool,
+        max_active_tasks: int | None,
+        daily_token_budget: int | None,
+        updated_at: datetime,
+    ) -> HostGovernancePolicy: ...
+
     def list_reserved_device_ids(self, *, now: datetime) -> set[str]: ...
 
     def assign_task(