Scope the read path by tenant (AUDIT-WP-0008-T04).

_read gated on may_read alone and never called permits_tenant, so any reader
credential could read every tenant through /v1/events, /v1/events/<id>,
/v1/dead-letters and /v1/secret-findings. Deployment bounded the exposure --
the only production sender holds may_read: false -- but the boundary was not in
the code, which is the difference between E2 and E1 on the tenancy posture
enforcement ladder.

Two rules, because the surfaces divide cleanly. Event reads are filtered to the
tenants the credential may act for. Surfaces with no tenant key to filter on --
stats, integrity, dead letters, secret findings -- require full tenant scope and
are refused rather than served instance-wide facts to a scoped reader.

A cross-tenant fetch returns 404 rather than 403. A distinguishable forbidden
would confirm that an event id exists and which tenant holds it, turning the
read surface into an existence oracle. Correlation lookup is filtered rather
than refused, since a correlation id legitimately spans tenants.

_readable_by fails closed: a record with no tenant is readable only at full
scope. Three existing tests read instance-wide surfaces with a scoped
credential, which this makes a 403; bound_app now carries an unrestricted
operator identity and those reads use it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

audit_core/senders.py

@@ -56,6 +56,16 @@ class SenderIdentity:
     def permits_source(self, source: str) -> bool:
         return WILDCARD in self.sources or source in self.sources
 
+    def has_full_tenant_scope(self) -> bool:
+        """Whether this identity is unrestricted across tenants.
+
+        The read surfaces that are not tenant-keyed — chain verification,
+        counters, dead letters, secret findings — cannot be filtered, so they
+        are reserved for an identity that could read every tenant anyway.
+        Anything else would hand a scoped reader instance-wide facts.
+        """
+        return WILDCARD in self.tenants
+
     def permits_tenant(self, tenant: str) -> bool:
         """Whether this identity may write for ``tenant``.