FLEX-WP-0035-T05: informed-decision lifecycle v2 declares application.access

- application.access allows only with purpose=readback and the authoring
  human bar; no workload path, no audience or client-scoped claims
- v1 operations unchanged; pin.json moves to v2; live pin stays v1 until T04
- examples/application-readback: readback catalogue with informed-decision's
  key-cape client binding; integration test over the shipped files

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 609675@bnt-lap001
Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212

examples/informed-decision-lifecycle/fixtures.json

@@ -17,5 +17,42 @@
     "expect": {
       "effect": "deny"
     }
+  },
+  {
+    "id": "application-access-without-readback-purpose-denied",
+    "request": {
+      "id": "application-access-enforcement",
+      "tenant": "tenant:platform",
+      "subject": {
+        "id": "human-one",
+        "type": "human",
+        "tenant": "tenant:platform",
+        "attributes": {
+          "groups": [
+            "net-kingdom-admins"
+          ],
+          "assurance": {
+            "level": "aal2",
+            "mfa": true,
+            "source": "key-cape",
+            "methods": [
+              "pwd",
+              "otp"
+            ],
+            "at": 0
+          }
+        }
+      },
+      "action": "application.access",
+      "resource": {
+        "id": "informed-decision",
+        "type": "application",
+        "system": "informed-decision"
+      }
+    },
+    "expect": {
+      "effect": "deny",
+      "reason": "lifecycle_scope_or_identity_refused"
+    }
   }
 ]