FLEX-WP-0035-T05: informed-decision lifecycle v2 declares application.access

- application.access allows only with purpose=readback and the authoring
  human bar; no workload path, no audience or client-scoped claims
- v1 operations unchanged; pin.json moves to v2; live pin stays v1 until T04
- examples/application-readback: readback catalogue with informed-decision's
  key-cape client binding; integration test over the shipped files

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 609675@bnt-lap001
Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212

examples/application-readback/README.md

@@ -0,0 +1,17 @@
+# Application access readback catalogue
+
+The readback pin's own registry (`FLEX-WP-0035`, `FLEX-DEC-2026-019`). It holds
+one entry per application that user-engine may list: id, display name, and the
+key-cape client its users sign in through. The entries are descriptive only and
+never decide an allow. Allow comes from each application's own package, which
+must declare `application.access`.
+
+Participants' registries are loaded alongside this one, and their packages are
+loaded at the same files their own pins run:
+
+| System | Package | Registry |
+| --- | --- | --- |
+| `informed-decision` | `examples/informed-decision-lifecycle/policy.md` (v2) | `examples/informed-decision-lifecycle/registry.json` |
+
+`client_binding` sources: `informed-decision/docs/keycape-client-registration.md`
+(`client_id`) and `informed-decision/informed_decision/oidc.py` (issuer).

examples/application-readback/registry_snapshot.json

@@ -0,0 +1,13 @@
+{
+  "systems": [
+    {
+      "id": "informed-decision",
+      "name": "Informed Decision",
+      "description": "Decision memos: authoring, collaboration and human review.",
+      "client_binding": {
+        "issuer": "https://kc.coulomb.social",
+        "client_id": "informed-decision-approver"
+      }
+    }
+  ]
+}