FLEX-WP-0008 T01-T02: tenant-engine resource/action vocabulary + policy package

docs/tenant-engine-{resource-namespace,action-vocabulary}.md: four actions
(tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign)
matching tenant_engine/src/tenant_engine/authz.py's _RESOURCE_TYPES mapping
exactly. No resource_manifest.yaml -- tenant-engine's resources are created
dynamically, unlike ops-warden's fixed SSH-certificate inventory; documented
as a deliberate deviation.

examples/tenant-engine/: protected_system_manifest.yaml, subject_manifest.yaml
(one registered caller: tenant-engine's own service identity),
policy_package.md (Rego rules + embedded tests), policy_fixtures.yaml (8
allow/deny pairs), assembled registry_snapshot.json, two standalone
check_request examples, README.

Design decision made explicit in the workplan: operator/service-identity
authorization (one known subject, four known actions), not aal2+assurance +
tenant-capability-role checking -- CheckRequest carries no assurance claim
yet (TEN-WP-0003 already flagged actor as a plain request-body field, not a
real auth context), and a tenant's capability roles are the tenant's own
state, not a property of who may call tenant-engine's admin API. Revisit
once KEY-WP-0005 gives callers a real assurance-bearing identity.

Verified for real: built ./cmd/flex-auth, ran test-policy (6 tests + 8
fixtures, all pass), load-registry, check against both example requests.
Then ran a live flex-auth serve with this exact registry+policy and pointed
tenant-engine's real, unmodified FlexAuthCheckClient/FlexAuthWriteAuthorizer
at it over real HTTP: unknown subject -> 403, tenant-engine -> 201. go test
./... still green across the whole repo.

T03 (live-lookup context adapter for other protected systems) stays open --
new Go adapter package, tracked separately.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

examples/tenant-engine/protected_system_manifest.yaml

@@ -0,0 +1,77 @@
+id: tenant-engine
+name: Tenant Engine
+resource_types:
+  - name: tenant
+    scope_level: Resource
+    planes:
+      - Identity
+      - Audit
+    metadata:
+      description: A tenant record (existence, onboarding grouping).
+  - name: role-grant
+    scope_level: Resource
+    planes:
+      - Identity
+      - Policy
+      - Audit
+    metadata:
+      description: A capability-role grant or revocation (PLTF/IAM/VEN/CUS).
+  - name: plan-assignment
+    scope_level: Resource
+    planes:
+      - Identity
+      - Audit
+    metadata:
+      description: A tenant's plan/subscription assignment (by reference id).
+actions:
+  - name: tenant.create
+    capabilities:
+      - Create
+      - Audit
+    planes:
+      - Identity
+      - Audit
+    exposure_modes:
+      - Metadata
+    metadata:
+      required_context: []
+  - name: tenant.role.grant
+    capabilities:
+      - Grant
+      - Audit
+    planes:
+      - Identity
+      - Policy
+      - Audit
+    exposure_modes:
+      - Metadata
+    metadata:
+      required_context: []
+  - name: tenant.role.revoke
+    capabilities:
+      - Revoke
+      - Audit
+    planes:
+      - Identity
+      - Policy
+      - Audit
+    exposure_modes:
+      - Metadata
+    metadata:
+      required_context: []
+  - name: tenant.plan.assign
+    capabilities:
+      - Bind
+      - Audit
+    planes:
+      - Identity
+      - Audit
+    exposure_modes:
+      - Metadata
+    metadata:
+      required_context: []
+caring_profiles:
+  - caring-0.4.0-rc2
+metadata:
+  flex_auth_contract: protected-system-v0
+  boundary_contract: net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md