Cover wrong-tenant denials in ops-warden and railiance-platform fixtures.

FLEX-WP-0022-T03: the rules already refused a foreign tenant; the fixture
suites never varied the field. No policy or version change. Asked
tenant-engine to name the CheckRequest tenant relation for T01/T02.

Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6

examples/ops-warden/check_request_deny_wrong_tenant.json

@@ -0,0 +1,23 @@
+{
+  "id": "check:ops-warden-wrong-tenant",
+  "tenant": "tenant:other",
+  "subject": {
+    "id": "platform-steward",
+    "type": "adm"
+  },
+  "action": "sign",
+  "resource": {
+    "id": "ssh-cert:actor/platform-steward",
+    "type": "ssh-certificate",
+    "system": "ops-warden"
+  },
+  "context": {
+    "principals": [
+      "platform",
+      "root"
+    ],
+    "actor_type": "adm",
+    "ttl_hours": 4,
+    "pubkey_fingerprint": "SHA256:example-adm-fingerprint"
+  }
+}