FLEX-WP-0008 T01-T02: tenant-engine resource/action vocabulary + policy package

docs/tenant-engine-{resource-namespace,action-vocabulary}.md: four actions
(tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign)
matching tenant_engine/src/tenant_engine/authz.py's _RESOURCE_TYPES mapping
exactly. No resource_manifest.yaml -- tenant-engine's resources are created
dynamically, unlike ops-warden's fixed SSH-certificate inventory; documented
as a deliberate deviation.

examples/tenant-engine/: protected_system_manifest.yaml, subject_manifest.yaml
(one registered caller: tenant-engine's own service identity),
policy_package.md (Rego rules + embedded tests), policy_fixtures.yaml (8
allow/deny pairs), assembled registry_snapshot.json, two standalone
check_request examples, README.

Design decision made explicit in the workplan: operator/service-identity
authorization (one known subject, four known actions), not aal2+assurance +
tenant-capability-role checking -- CheckRequest carries no assurance claim
yet (TEN-WP-0003 already flagged actor as a plain request-body field, not a
real auth context), and a tenant's capability roles are the tenant's own
state, not a property of who may call tenant-engine's admin API. Revisit
once KEY-WP-0005 gives callers a real assurance-bearing identity.

Verified for real: built ./cmd/flex-auth, ran test-policy (6 tests + 8
fixtures, all pass), load-registry, check against both example requests.
Then ran a live flex-auth serve with this exact registry+policy and pointed
tenant-engine's real, unmodified FlexAuthCheckClient/FlexAuthWriteAuthorizer
at it over real HTTP: unknown subject -> 403, tenant-engine -> 201. go test
./... still green across the whole repo.

T03 (live-lookup context adapter for other protected systems) stays open --
new Go adapter package, tracked separately.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

examples/tenant-engine/README.md

@@ -0,0 +1,58 @@
+# tenant-engine Consumer Integration Fixtures
+
+`FLEX-WP-0008-T01`/`T02`. Registers `tenant-engine` as a flex-auth
+protected-system consumer, gating its own write API
+(`TEN-WP-0003`'s `authz.FlexAuthWriteAuthorizer`).
+
+## Files
+
+| File | Purpose |
+| --- | --- |
+| `protected_system_manifest.yaml` | Resource types (`tenant`, `role-grant`, `plan-assignment`) and actions (`tenant.create`, `tenant.role.grant`, `tenant.role.revoke`, `tenant.plan.assign`) |
+| `subject_manifest.yaml` | The one registered caller: `tenant-engine`'s own service identity |
+| `policy_package.md` | Rego rules + embedded tests gating the write API |
+| `policy_fixtures.yaml` | Allow/deny request/decision pairs, referenced by `policy_package.md`'s frontmatter |
+| `registry_snapshot.json` | Merged `systems`/`subjects`/`groups` snapshot assembled from the two manifests above, loadable by `flex-auth serve`/`check`/`load-registry` |
+| `check_request_allow_create.json`, `check_request_deny_unknown_subject.json` | Standalone example requests for `flex-auth check` |
+
+**No `resource_manifest.yaml`** — unlike ops-warden's fixed SSH-certificate
+inventory, `tenant-engine`'s resources (tenants) are created dynamically.
+See `docs/tenant-engine-resource-namespace.md` for why that's a deliberate
+omission, not an oversight.
+
+## Verified
+
+```bash
+go build -o bin/flex-auth ./cmd/flex-auth
+
+# Rego rules + embedded tests + fixtures, all pass:
+bin/flex-auth test-policy -file examples/tenant-engine/policy_package.md
+
+# Registry loads cleanly:
+bin/flex-auth load-registry -file examples/tenant-engine/registry_snapshot.json
+
+# Individual requests via the CLI:
+bin/flex-auth check \
+  -registry examples/tenant-engine/registry_snapshot.json \
+  -policy examples/tenant-engine/policy_package.md \
+  -request examples/tenant-engine/check_request_allow_create.json
+
+# End-to-end over real HTTP: a live `flex-auth serve` loaded with this
+# exact registry+policy, hit by tenant-engine's actual
+# FlexAuthCheckClient/FlexAuthWriteAuthorizer (not a mock) --
+# POST /tenants with actor="ops" -> 403 (unknown_subject);
+# actor="tenant-engine" -> 201 (write_api_policy_matched).
+bin/flex-auth serve -addr 127.0.0.1:9098 \
+  -registry examples/tenant-engine/registry_snapshot.json \
+  -policy examples/tenant-engine/policy_package.md
+# (from tenant-engine's own checkout)
+TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098 make run
+```
+
+## Related
+
+- `docs/tenant-engine-resource-namespace.md`
+- `docs/tenant-engine-action-vocabulary.md`
+- `tenant-engine/docs/flex-auth-integration.md` — the client side of this
+  integration
+- `net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md`