Make undeclared policy attribute reads a validate error.

FLEX-WP-0025-T03: flex-auth validate flags input.*.attributes keys that
no sibling registry or manifest supplies. A broken testdata package
proves tests can pass while the ceiling remains caller-only.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

examples/informed-decision-t03/registry.json

@@ -1 +1,17 @@
-{"subjects": [], "resources": []}
+{
+  "subjects": [
+    {
+      "id": "t03-reviewer",
+      "type": "Human",
+      "display_name": "T03 reviewer",
+      "organization_relation": "ServiceProvider",
+      "groups": ["net-kingdom-admins"],
+      "claims": {
+        "assurance": "aal2",
+        "principal_type_source": "authentication-derived",
+        "tenant_source": "registration-supplied"
+      }
+    }
+  ],
+  "resources": []
+}

examples/markitect/subject_manifest.yaml

@@ -0,0 +1,24 @@
+id: subjects:markitect-example
+subjects:
+  - id: user:visitor
+    type: Human
+    display_name: Visitor
+    organization_relation: Customer
+    roles: []
+    groups: []
+    tenant: tenant:alpha
+  - id: user:steward
+    type: Human
+    display_name: Steward
+    organization_relation: ServiceProvider
+    roles:
+      - Operator
+    groups:
+      - group:platform-architecture
+    tenant: tenant:alpha
+groups:
+  - id: group:platform-architecture
+    display_name: Platform Architecture
+    members:
+      - user:steward
+    tenant: tenant:alpha