APPROVAL-WP-0007-T01 done: required_assurance floor; executor ingress; alignment answer

- Optional required_assurance {"level": aal1|aal2|aal3} at issue, schema v7.
  Enforced at add_entry (403), claim (assurance_unsatisfied) and consume (409)
  from the verified token level only; inherited on supersession; legacy rows
  NULL. Served only when declared so undeclared claims keep exact bytes.
- deploy/networkpolicies.yaml: pod-scoped ingress for sso +
  app.kubernetes.io/name=bounded-executor on 8080 (hub 39a3bffa). Not applied.
- docs/decision-services-alignment-answer.md: owner answer to the NetKingdom
  decision services review (hub 81cafbf3): roles accepted, T02 split proposed,
  presentation_ref at create declined with an entry-level counter-proposal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

approval_engine/api.py

@@ -133,6 +133,7 @@ class App:
                 pdp_digest=data.get("pdp_digest"),
                 pdp_path=bool(data.get("pdp_path", False)),
                 human_control=data.get("human_control", False),
+                required_assurance=data.get("required_assurance"),
                 approval_id=data.get("id"),
             )
             return 201, obj.as_dict()