Add an offline attribute-admission branch beside exact-record review.

Compact-sitting v8 can admit a new memo from carried class, submitter, and approval attributes, but shipped sets are empty and exact-record decisions stay on their pins. The sitting image pin is unchanged.

Assistant: grok
Assistant-Session: 01a10329-31cb-78d3-b7a3-788c2f91d6d4

tests/stage1.sh

@@ -53,6 +53,11 @@ echo "$fetch_render" | grep -q examples/ops-warden-fetch/policy_package.md \
 python3 tools/gen_ops_warden_fetch.py --check >/dev/null 2>&1 || [ ! -f "${HOME}/ops-warden/registry/routing/catalog.yaml" ] \
   || { echo "ops-warden-fetch is out of date with the routing catalog; run tools/gen_ops_warden_fetch.py" >&2; exit 1; }
 
+if [ -f "${HOME}/informed-decision/deploy/intake-submitters.json" ]; then
+  python3 tools/gen_informed_decision_admission.py --check >/dev/null \
+    || { echo "informed-decision attribute admission sets drifted; run tools/gen_informed_decision_admission.py" >&2; exit 1; }
+fi
+
 canary_render="$(helm template flex-auth-canary charts/flex-auth -f values/stage2-canary.yaml --namespace flex-auth)"
 if echo "$canary_render" | grep -q tokenreviews; then
   echo "isolated canary must not create TokenReview RBAC" >&2