Finish FLEX-WP-0019 layer-model v0.7 conformance

Close the remaining PDP obligations: mechanical layer declaration check,
registry-snapshot digest in provenance, explicit allow TTL, per-input-class
freshness deadlines, and the published decision-record contract. Document
the canonical request digest as the §6.4.2 replay test.

Assistant: grok
Assistant-Session: 01a06256-fb71-7102-b3a9-27e6734257d0

examples/caring/action_authorization.json

@@ -47,6 +47,7 @@
   },
   "decision": {
     "id": "decision:contract-example",
+    "contract_version": "flex-auth.decision-record.v1",
     "request_id": "check:secrets-engine-destroy-example",
     "effect": "allow",
     "reason": "destruction_approved",
@@ -87,7 +88,13 @@
       "context": {
         "purpose": "contract-test"
       },
-      "request_digest": "sha256:73d5d7d5b3363f1a1db8f4c0e79c8f33dae5d77ffb97f21e449438bc0defa4c3"
+      "request_digest": "sha256:eb9d856a060813aebe039f19b82d4be1c4589fa6c0429cf20e15fb115db3ef9a"
+    },
+    "lifetime": {
+      "kind": "ttl",
+      "ttl": "15m",
+      "not_before": "2026-08-23T10:00:30Z",
+      "expires_at": "2026-08-23T10:15:30Z"
     },
     "provenance": {
       "evaluator": "flex-auth/local",