Auto-attachment of policies to Intent Projects via labels

Workaround

Current behavior Today, attaching a policy to an Intent Project is a manual, per-project action: navigate to Try New Features > Intent Projects > [project] > Policies tab > Attach policy, then select the policy from the dropdown. This has to be repeated for every new Intent Project, for every policy that should apply to it.

Problem

Intent Projects are designed for speed — spinning up short-lived environments for QA, demos, prototypes, or exploratory work via natural language. The manual policy attachment step directly undermines that value proposition: - It doesn't scale. A platform team governing dozens or hundreds of developer-owned Intent Projects can't realistically click through each one to attach the standard guardrails (e.g., "no public S3 buckets", "no expensive instance types", "region allowlist"). - It's error-prone. If a user forgets to attach the organization's baseline Intent policy to a new project, the project runs ungoverned — the exact opposite of Spacelift's "governed by default" promise for the commercial Intent offering. - It's inconsistent with the rest of the platform. Policies, contexts, and cloud integrations already support `autoattach:<label>` for stacks and modules. Intent Projects are the odd one out.