Set the approval store tenant to exact tenant:platform

Operator decision 5ed3fb35-eca9-413a-82b9-95171ba85bf6 accepts tenant:platform
as the platform management, administration and services tenant, with no alias
to platform or tenant:coulomb and no implicit cross-tenant grant. This closes
the collision recorded in 5c87ba8, where the manifest served --tenant platform
while the requested registrations issued tenant:coulomb.

The store tenant is now exactly tenant:platform in the manifest, the CLI
default, and the Engine default, and the requested client registrations ask for
the same spelling. Exact JWT/store equality is retained: no mapping table, no
normalisation, no prefix handling.

Moving the defaults rather than only the manifest is deliberate. A default of
platform under a sanctioned value of tenant:platform is a trap, because a serve
that omits --tenant would come up healthy and then refuse every authenticated
call -- the exact failure this decision exists to prevent.

That default change broke ten tests whose identity fixtures hard-coded
platform. This is the hazard flex-auth reported as FLEX-DEC-2026-008: fixtures
that all carry one tenant prove nothing about the tenant field. Fixtures are
aligned to the exact spelling, and the field is now varied rather than merely
present. test_near_miss_tenant_spellings_are_forbidden refuses platform,
tenant:coulomb, case variants, whitespace variants and empty against a
tenant:platform store; test_exact_sanctioned_tenant_is_admitted pins the other
half so a reject-everything bug cannot pass it. 111 tests pass.

Also records the credential-independent half of the GLAS-WP-0015 image request:
the image builds non-root uid 10001 off the pinned base, carries schema v3 and
the new tenant default, migrates and verifies a fresh store to schema_version 3
with integrity ok, and refuses production without a persistent database or
authenticated audit delivery. No scan was run -- no scanner is installed here --
and no release digest exists, so T01 and T03 both stay open.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PM5HnEAhokxdfcPqBNpT7D

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 715850@bnt-lap001
Assistant-Session: eb557e93-7cb1-45d0-9e57-7d15b3edc60e

tests/test_auth.py

@@ -118,7 +118,7 @@ def test_api_requires_scope_and_binds_create_actor(engine):
         issuer="test",
         audiences=("approval-engine",),
         principal_type="service",
-        tenant="platform",
+        tenant="tenant:platform",
         roles=frozenset(),
         scopes=frozenset({"approval:create"}),
         assurance={"level": "aal1"},
@@ -201,6 +201,72 @@ def test_wrong_tenant_is_forbidden(engine):
     assert body["error"] == "forbidden"
 
 
+@pytest.mark.parametrize(
+    "tenant",
+    [
+        "platform",
+        "tenant:coulomb",
+        "TENANT:PLATFORM",
+        "Tenant:Platform",
+        "tenant:platform ",
+        " tenant:platform",
+        "tenant:platform:",
+        "",
+    ],
+)
+def test_near_miss_tenant_spellings_are_forbidden(engine, tenant):
+    """Decision 5ed3fb35 accepted exactly `tenant:platform` with no alias.
+
+    The store comparison is exact string equality, so every near miss below must
+    be refused: the bare `platform` this repo used to serve, the `tenant:coulomb`
+    the registrations used to request, case variants, and whitespace. Varying the
+    field is the point — a suite whose fixtures all carry the sanctioned value
+    proves nothing about the tenant check.
+    """
+    identity = Identity(
+        subject="agt-secrets-engine",
+        issuer="test",
+        audiences=("approval-engine",),
+        principal_type="service",
+        tenant=tenant,
+        roles=frozenset(),
+        scopes=frozenset({"approval:observe"}),
+        assurance={},
+        evidence_ref="test",
+    )
+    from approval_engine.api import App
+
+    app = App(engine, StaticTokenAuthenticator({"near": identity}))
+    status, body = call(app, "GET", "/v1/cadence", authorization="Bearer near")
+    assert status == 403, f"{tenant!r} was admitted as an alias"
+    assert body["error"] == "forbidden"
+
+
+def test_exact_sanctioned_tenant_is_admitted(engine):
+    """The other half of the pin: the exact spelling must actually work.
+
+    Without this, a bug that rejected every tenant would pass the near-miss test
+    above while denying the sanctioned caller too.
+    """
+    assert engine.tenant == "tenant:platform"
+    identity = Identity(
+        subject="agt-secrets-engine",
+        issuer="test",
+        audiences=("approval-engine",),
+        principal_type="service",
+        tenant="tenant:platform",
+        roles=frozenset(),
+        scopes=frozenset({"approval:observe"}),
+        assurance={},
+        evidence_ref="test",
+    )
+    from approval_engine.api import App
+
+    app = App(engine, StaticTokenAuthenticator({"exact": identity}))
+    status, _ = call(app, "GET", "/v1/cadence", authorization="Bearer exact")
+    assert status == 200
+
+
 def test_deny_all_default_does_not_mutate(engine):
     from approval_engine.api import App
 
@@ -225,7 +291,7 @@ def test_human_principal_cannot_consume(engine):
         issuer="test",
         audiences=("approval-engine",),
         principal_type="service",
-        tenant="platform",
+        tenant="tenant:platform",
         roles=frozenset(),
         scopes=frozenset(
             {"approval:create", "approval:approve", "approval:read", "approval:consume"}
@@ -238,7 +304,7 @@ def test_human_principal_cannot_consume(engine):
         issuer="test",
         audiences=("approval-engine",),
         principal_type="human",
-        tenant="platform",
+        tenant="tenant:platform",
         roles=frozenset(),
         scopes=frozenset({"approval:consume"}),
         assurance={"level": "aal2"},