Support metadata labels from IR plans

Summary

OPA recently added support for metadata labels on Rego rules (see open-policy-agent/opa#8613 and the follow-up commit 913739161). Labels are arbitrary key-value pairs that policy authors attach to rules via the # METADATA annotation block. When a labeled rule is successfully evaluated, the OPA runtime collects the labels and includes them in decision log entries under a rule_labels field. Labels can be defined at rule, document, package, or subpackages scope, and OPA's compiler aggregates them so that each rule carries the full set of inherited labels from all applicable scopes.

Today, none of this metadata survives the IR planning stage in OPA. There is an upstream issue to extend the IR data model so that labels are carried through to the plan output (see the corresponding OPA issue). Once that work lands, java-opa-sdk will need to be updated to read label metadata from the IR plan and surface it to callers after evaluation.

This presumes decision log support, #7.

What this would involve

Once the upstream IR format includes label metadata, java-opa-sdk would need to parse the new fields from the plan JSON, associate them with the corresponding planned functions, and collect the labels of rules that fire during evaluation. The deduplication behavior (suppressing exact-duplicate label maps) should match OPA's semantics. The collected labels should be made available to the caller as part of the evaluation result, whether through a decision-log-like structure or a simpler metadata accessor on the result type.

References

• Upstream OPA PR that introduced labels: https://github.com/open-policy-agent/opa/pull/8613
• Planner issue: https://github.com/open-policy-agent/opa/issues/8644

Start by reviewing decision log support in issue #7, the OPA labels PR 8613, and planner issue 8644 to confirm the upstream IR shape and prerequisites. Then inspect the SDK's IR-plan parsing, planned-function evaluation, and evaluation result API. Done means inherited rule labels are collected with OPA-compatible deduplication and exposed to callers after evaluation.