Add producer-owned authenticated Go decision client and validated Forgejo profile

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7

internal/decision/engine.go

@@ -470,7 +470,7 @@ func (e *Engine) envelope(ctx context.Context, request, submitted api.CheckReque
 		},
 		Provenance: api.DecisionProvenance{
 			Evaluator:              "flex-auth/local",
-			Mode:                   "standalone",
+			Mode:                   envelopeMode(ctx),
 			PolicyPackage:          e.policy.Metadata.ID,
 			PolicyVersion:          e.policy.Metadata.Version,
 			PolicyPackageDigest:    e.policy.Digest(),

internal/decision/json_profile.go

@@ -0,0 +1,25 @@
+package decision
+
+import "context"
+
+// LosslessJSONProfile is an explicit optional wire decoder profile for the
+// normal /v1/check handler. Legacy callers retain their original float64
+// projection. The canonical request and signature algorithms are unchanged.
+const LosslessJSONProfile = "lossless-json-v1"
+const losslessStandaloneMode = "standalone/lossless-json-v1"
+
+type jsonProfileContextKey struct{}
+
+// WithLosslessJSONProfile is called only by the producer after selecting its
+// UseNumber decoder. No request/body flag can install this context key. The
+// signed provenance mode authenticates which decoder produced the decision.
+func WithLosslessJSONProfile(ctx context.Context) context.Context {
+	return context.WithValue(ctx, jsonProfileContextKey{}, LosslessJSONProfile)
+}
+
+func envelopeMode(ctx context.Context) string {
+	if ctx.Value(jsonProfileContextKey{}) == LosslessJSONProfile {
+		return losslessStandaloneMode
+	}
+	return "standalone"
+}