P2: Shield Service — Compliance Screening + PGA + Alerts

Build the Shield service (rosetta-shield) as a FastAPI application for real-time compliance screening. Endpoints: POST /screen, POST /pga, GET /alerts Core logic: 1. Denied Party Screening — fuzzy match entity against SDN, DPL, EL, UVL, UFLPA, MEU lists cached in Cloud SQL 2. PGA Requirements — determine FDA/EPA/USDA/CPSC requirements from HTS code using c8_trade_ref tables 3. UFLPA Screening — cotton/tomato/polysilicon provenance check for Xinjiang entities 4. Alerts — subscribe to Pub/Sub screening.completed events, generate severity-ranked alerts 5. Decision engine — PASS (no matches), HOLD (fuzzy match >70%), BLOCK (exact match on any list) Database: Cloud SQL schema at c8-infra/sql/001_initial_schema.sql (screenings, denied_parties, alerts tables) Metering: Every screen = billable event via metering.py Model: Uses Opus 4.6 for nuanced entity matching with context Reference: - c8_platform/c8_memory_tools.py — determine_pga_requirements tool - c8_platform/askrosetta_api/ — API patterns - BigQuery tables: duty-pay.c8_trade_ref.bis_entity_list, fda_* tables Output: Complete shield/ directory with main.py, screening/, pga/, alerts/, requirements-shield.txt Target: c8-infra/shield/