Authorize tenant-engine lifecycle actions (FLEX-WP-0010)

Extend the tenant-engine write-API policy package with tenant.update,
tenant.retire, and tenant.reactivate, the three actions TEN-WP-0005
introduced. Until now every lifecycle mutation resolved to deny
unknown_action, blocking TEN-WP-0005-T05 production rollout.

- policy_package.md: three actions in valid_actions and frontmatter;
  CARING capabilities extended with EditAny/Archive/Restore
- protected_system_manifest.yaml, subject_manifest.yaml, and the rebuilt
  registry_snapshot.json carry all seven actions
- docs/tenant-engine-action-vocabulary.md documents the HTTP surfaces
- 8 new fixture pairs and 5 new Rego tests, including action-drift
  guards (tenant.retired, tenant_update -> unknown_action)

T02 decision, recorded in policy_package.md: tenant.retire does NOT get
stricter authorization yet. With one service subject and no assurance
claim in the CheckRequest there is nothing stricter to check, and a
condition the sole caller always satisfies would falsely read as
separate control. Retirement is reversible and non-destructive. Revisit
on KEY-WP-0005 assurance claims or a second operator subject.

Verified: 11/11 Rego tests, 16/16 fixtures, go test ./... green, gofmt
and go vet clean. End-to-end against a live serve with a real
tenant-engine through the unmodified FlexAuthWriteAuthorizer: update
6176c39c2f4d7b15, retire 8a801b8ee8455080, reactivate c64cf3713cecd970
all allow; unregistered actor denied unknown_subject
(59d3e99c6416be89, 403 write_denied).

Handoff revision for TEN-WP-0005-T05: package
tenant-engine.write-api.mutate v1 (ready, caring-0.4.0-rc2).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

examples/tenant-engine/subject_manifest.yaml

@@ -14,9 +14,11 @@ subjects:
     tenant: tenant:platform
     metadata:
       description: >-
-        tenant-engine's own service identity, used for the tenant.create /
-        tenant.role.grant / tenant.role.revoke / tenant.plan.assign actions
-        it sends to POST /v1/check (authz.FlexAuthWriteAuthorizer).
+        tenant-engine's own service identity, used for the seven write-API
+        actions it sends to POST /v1/check
+        (authz.FlexAuthWriteAuthorizer): tenant.create, tenant.role.grant,
+        tenant.role.revoke, tenant.plan.assign, and the lifecycle actions
+        tenant.update, tenant.retire, tenant.reactivate.
 groups:
   - id: group:tenant-engine-writers
     display_name: tenant-engine Write API Callers