Cover wrong-tenant denials in ops-warden and railiance-platform fixtures.

FLEX-WP-0022-T03: the rules already refused a foreign tenant; the fixture
suites never varied the field. No policy or version change. Asked
tenant-engine to name the CheckRequest tenant relation for T01/T02.

Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6

examples/ops-warden/policy_fixtures.yaml

@@ -394,5 +394,50 @@
       "effect": "audit_only",
       "reason": "advisory_would_signing_policy_matched"
     }
+  },
+  {
+    "id": "fixture:ops-warden-wrong-tenant-deny",
+    "request": {
+      "id": "check:ops-warden-wrong-tenant",
+      "tenant": "tenant:other",
+      "subject": {
+        "id": "platform-steward",
+        "type": "adm"
+      },
+      "action": "sign",
+      "resource": {
+        "id": "ssh-cert:actor/platform-steward",
+        "type": "ssh-certificate",
+        "system": "ops-warden",
+        "attributes": {
+          "actor_id": "platform-steward",
+          "actor_type": "adm",
+          "allowed_subjects": [
+            "platform-steward",
+            "iam:platform-steward"
+          ],
+          "allowed_principals": [
+            "platform",
+            "root"
+          ],
+          "max_ttl_hours": 8,
+          "security_zone": "z2-protected",
+          "security_zone_admission": "satisfied"
+        }
+      },
+      "context": {
+        "principals": [
+          "platform",
+          "root"
+        ],
+        "actor_type": "adm",
+        "ttl_hours": 4,
+        "pubkey_fingerprint": "SHA256:example-adm-fingerprint"
+      }
+    },
+    "expect": {
+      "effect": "deny",
+      "reason": "wrong_tenant"
+    }
   }
 ]