Finish FLEX-WP-0019 layer-model v0.7 conformance

Close the remaining PDP obligations: mechanical layer declaration check,
registry-snapshot digest in provenance, explicit allow TTL, per-input-class
freshness deadlines, and the published decision-record contract. Document
the canonical request digest as the §6.4.2 replay test.

Assistant: grok
Assistant-Session: 01a06256-fb71-7102-b3a9-27e6734257d0

tools/check_layer_conformance.go

@@ -0,0 +1,28 @@
+// Command check_layer_conformance asserts the INTENT.md layer declaration
+// and that no Tooling client exists in production Go sources.
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/netkingdom/flex-auth/internal/layer"
+)
+
+func main() {
+	root, err := os.Getwd()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(2)
+	}
+	if _, err := os.Stat(filepath.Join(root, "INTENT.md")); err != nil {
+		fmt.Fprintf(os.Stderr, "INTENT.md not found in %s\n", root)
+		os.Exit(2)
+	}
+	if err := layer.Check(root); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	fmt.Println("PASS — Engine/PDP declaration parses; no Tooling client in the tree.")
+}