- client.py: restore `import functools`, dropped by a master-side
  cleanup that the PR permitio#673 merge didn't re-add, even though the
  merged-in rehydration-callback setup (shared across OPA/Cedar/OpenFGA)
  calls functools.partial.
- engine/runner.py: implement the abstract health_check() on
  OpenFGARunner. Master added health_check() as an abstract method on
  PolicyEngineRunner after PR permitio#673 was opened, so OpaRunner/CedarRunner
  got updated but OpenFGARunner never did — the client crashed on boot
  with "Can't instantiate abstract class OpenFGARunner".

Verified via app-tests/docker-compose-app-tests-openfga.yml: opal
server + client-openfga now boot, sync policy/data to OpenFGA, and all
17 cases in app-tests/openfga-test.py pass.

- client.py: restore `import functools`, dropped by a master-side
  cleanup that the PR permitio#673 merge didn't re-add, even though the
  merged-in rehydration-callback setup (shared across OPA/Cedar/OpenFGA)
  calls functools.partial.
- engine/runner.py: implement the abstract health_check() on
  OpenFGARunner. Master added health_check() as an abstract method on
  PolicyEngineRunner after PR permitio#673 was opened, so OpaRunner/CedarRunner
  got updated but OpenFGARunner never did — the client crashed on boot
  with "Can't instantiate abstract class OpenFGARunner".

Verified via app-tests/docker-compose-app-tests-openfga.yml: opal
server + client-openfga now boot, sync policy/data to OpenFGA, and all
17 cases in app-tests/openfga-test.py pass.

- client.py: restore `import functools`, dropped by a master-side
  cleanup that the PR permitio#673 merge didn't re-add, even though the
  merged-in rehydration-callback setup (shared across OPA/Cedar/OpenFGA)
  calls functools.partial.
- engine/runner.py: implement the abstract health_check() on
  OpenFGARunner. Master added health_check() as an abstract method on
  PolicyEngineRunner after PR permitio#673 was opened, so OpaRunner/CedarRunner
  got updated but OpenFGARunner never did — the client crashed on boot
  with "Can't instantiate abstract class OpenFGARunner".

Verified via app-tests/docker-compose-app-tests-openfga.yml: opal
server + client-openfga now boot, sync policy/data to OpenFGA, and all
17 cases in app-tests/openfga-test.py pass.

- client.py: restore `import functools`, dropped by a master-side
  cleanup that the PR permitio#673 merge didn't re-add, even though the
  merged-in rehydration-callback setup (shared across OPA/Cedar/OpenFGA)
  calls functools.partial.
- engine/runner.py: implement the abstract health_check() on
  OpenFGARunner. Master added health_check() as an abstract method on
  PolicyEngineRunner after PR permitio#673 was opened, so OpaRunner/CedarRunner
  got updated but OpenFGARunner never did — the client crashed on boot
  with "Can't instantiate abstract class OpenFGARunner".

Verified via app-tests/docker-compose-app-tests-openfga.yml: opal
server + client-openfga now boot, sync policy/data to OpenFGA, and all
17 cases in app-tests/openfga-test.py pass.

- client.py: restore `import functools`, dropped by a master-side
  cleanup that the PR permitio#673 merge didn't re-add, even though the
  merged-in rehydration-callback setup (shared across OPA/Cedar/OpenFGA)
  calls functools.partial.
- engine/runner.py: implement the abstract health_check() on
  OpenFGARunner. Master added health_check() as an abstract method on
  PolicyEngineRunner after PR permitio#673 was opened, so OpaRunner/CedarRunner
  got updated but OpenFGARunner never did — the client crashed on boot
  with "Can't instantiate abstract class OpenFGARunner".

Verified via app-tests/docker-compose-app-tests-openfga.yml: opal
server + client-openfga now boot, sync policy/data to OpenFGA, and all
17 cases in app-tests/openfga-test.py pass.

- client.py: restore `import functools`, dropped by a master-side
  cleanup that the PR permitio#673 merge didn't re-add, even though the
  merged-in rehydration-callback setup (shared across OPA/Cedar/OpenFGA)
  calls functools.partial.
- engine/runner.py: implement the abstract health_check() on
  OpenFGARunner. Master added health_check() as an abstract method on
  PolicyEngineRunner after PR permitio#673 was opened, so OpaRunner/CedarRunner
  got updated but OpenFGARunner never did — the client crashed on boot
  with "Can't instantiate abstract class OpenFGARunner".

Verified via app-tests/docker-compose-app-tests-openfga.yml: opal
server + client-openfga now boot, sync policy/data to OpenFGA, and all
17 cases in app-tests/openfga-test.py pass.

- client.py: restore `import functools`, dropped by a master-side
  cleanup that the PR permitio#673 merge didn't re-add, even though the
  merged-in rehydration-callback setup (shared across OPA/Cedar/OpenFGA)
  calls functools.partial.
- engine/runner.py: implement the abstract health_check() on
  OpenFGARunner. Master added health_check() as an abstract method on
  PolicyEngineRunner after PR permitio#673 was opened, so OpaRunner/CedarRunner
  got updated but OpenFGARunner never did — the client crashed on boot
  with "Can't instantiate abstract class OpenFGARunner".

Verified via app-tests/docker-compose-app-tests-openfga.yml: opal
server + client-openfga now boot, sync policy/data to OpenFGA, and all
17 cases in app-tests/openfga-test.py pass.

Adds OpenFGA as a supported policy store backend (originally contributed
via permitio#673 from daveads/opal), with fixes to make it actually
work end-to-end:

- New OPENFGA policy store: OpenFGAClient (opal-client) syncs policy and
  data updates to an OpenFGA server, following the same pattern as the
  existing OPA/Cedar backends.
- Inline OpenFGA support: the client-openfga Docker image runs an embedded
  OpenFGA server via scripts/start-openfga.sh, which starts OpenFGA, waits
  for it to be healthy, and auto-creates a store when
  OPAL_OPENFGA_STORE_ID isn't set (replacing a broken supervisord-based
  CMD override that never actually started the opal-client process, and a
  hardcoded store id that only existed in the original author's own
  OpenFGA instance).
- App tests: app-tests/openfga-test.py exercises permission checks,
  relationship reads, and authorization-model validation against a live
  OpenFGA instance. app-tests/run-openfga-services.sh now builds both the
  client-openfga and server images from source (permitio/opal-client-openfga
  isn't published anywhere, and opal-server needs this branch's changes -
  pulling the published image would silently run unpatched upstream code),
  waits for opal-client's /ready endpoint instead of a fixed sleep, and
  discovers the auto-created store id at runtime instead of assuming a
  fixed one.
- opal_server's default all-data route now searches the policy repo clone
  for a data file (data.json by default) instead of always returning {},
  with a short bounded retry to cover the repo clone still being in
  progress on first request.
- OpenFGAClient.set_policy_data treats an empty {} data payload as zero
  tuples (a valid state) instead of raising - relevant when no data source
  is configured, or briefly during the clone race above.
- Fixed openfga-app-test.yml's trigger (branches: [test] -> [master]) so
  it actually runs in CI.
- Restored a dropped `import functools` and implemented the abstract
  OpenFGARunner.health_check(), both required by changes to master that
  landed after PR permitio#673 was opened.