Finish FLEX-WP-0019 layer-model v0.7 conformance

Close the remaining PDP obligations: mechanical layer declaration check,
registry-snapshot digest in provenance, explicit allow TTL, per-input-class
freshness deadlines, and the published decision-record contract. Document
the canonical request digest as the §6.4.2 replay test.

Assistant: grok
Assistant-Session: 01a06256-fb71-7102-b3a9-27e6734257d0

examples/caring/decision_envelope.json

@@ -1,5 +1,6 @@
 {
   "id": "decision:tenant-alpha-internal-note",
+  "contract_version": "flex-auth.decision-record.v1",
   "request_id": "check:tenant-alpha-internal-note",
   "effect": "allow",
   "reason": "reader_relation",
@@ -33,7 +34,13 @@
     "context": {
       "purpose": "project-delivery"
     },
-    "request_digest": "sha256:76ddf09170fc5ac49fb58aa9a6f5fb25bf1eb68b969254553979eb1ee0f15fab"
+    "request_digest": "sha256:99f772642c55b232a2d2fd3d5ff223cf1bf2c4f68942cd0def7c02cd3e5ae6ae"
+  },
+  "lifetime": {
+    "kind": "ttl",
+    "ttl": "15m",
+    "not_before": "2026-05-17T00:00:00Z",
+    "expires_at": "2026-05-17T00:15:00Z"
   },
   "obligations": [
     {
@@ -51,6 +58,11 @@
     "mode": "standalone",
     "policy_package": "markitect.documents",
     "policy_version": "v1",
+    "policy_package_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "registry_snapshot_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+    "input_claim_digests": {
+      "context": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+    },
     "decision_time": "2026-05-17T00:00:00Z"
   },
   "caring": {