Authorize tenant-engine lifecycle actions (FLEX-WP-0010)

Extend the tenant-engine write-API policy package with tenant.update,
tenant.retire, and tenant.reactivate, the three actions TEN-WP-0005
introduced. Until now every lifecycle mutation resolved to deny
unknown_action, blocking TEN-WP-0005-T05 production rollout.

- policy_package.md: three actions in valid_actions and frontmatter;
  CARING capabilities extended with EditAny/Archive/Restore
- protected_system_manifest.yaml, subject_manifest.yaml, and the rebuilt
  registry_snapshot.json carry all seven actions
- docs/tenant-engine-action-vocabulary.md documents the HTTP surfaces
- 8 new fixture pairs and 5 new Rego tests, including action-drift
  guards (tenant.retired, tenant_update -> unknown_action)

T02 decision, recorded in policy_package.md: tenant.retire does NOT get
stricter authorization yet. With one service subject and no assurance
claim in the CheckRequest there is nothing stricter to check, and a
condition the sole caller always satisfies would falsely read as
separate control. Retirement is reversible and non-destructive. Revisit
on KEY-WP-0005 assurance claims or a second operator subject.

Verified: 11/11 Rego tests, 16/16 fixtures, go test ./... green, gofmt
and go vet clean. End-to-end against a live serve with a real
tenant-engine through the unmodified FlexAuthWriteAuthorizer: update
6176c39c2f4d7b15, retire 8a801b8ee8455080, reactivate c64cf3713cecd970
all allow; unregistered actor denied unknown_subject
(59d3e99c6416be89, 403 write_denied).

Handoff revision for TEN-WP-0005-T05: package
tenant-engine.write-api.mutate v1 (ready, caring-0.4.0-rc2).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

examples/tenant-engine/protected_system_manifest.yaml

@@ -70,6 +70,41 @@ actions:
       - Metadata
     metadata:
       required_context: []
+  - name: tenant.update
+    capabilities:
+      - EditAny
+      - Audit
+    planes:
+      - Identity
+      - Audit
+    exposure_modes:
+      - Metadata
+    metadata:
+      required_context: []
+  - name: tenant.retire
+    capabilities:
+      - Archive
+      - Audit
+    planes:
+      - Identity
+      - Policy
+      - Audit
+    exposure_modes:
+      - Metadata
+    metadata:
+      required_context: []
+  - name: tenant.reactivate
+    capabilities:
+      - Restore
+      - Audit
+    planes:
+      - Identity
+      - Policy
+      - Audit
+    exposure_modes:
+      - Metadata
+    metadata:
+      required_context: []
 caring_profiles:
   - caring-0.4.0-rc2
 metadata: