Make undeclared policy attribute reads a validate error.

FLEX-WP-0025-T03: flex-auth validate flags input.*.attributes keys that
no sibling registry or manifest supplies. A broken testdata package
proves tests can pass while the ceiling remains caller-only.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

examples/informed-decision-t03/registry.json

@@ -1 +1,17 @@
-{"subjects": [], "resources": []}
+{
+  "subjects": [
+    {
+      "id": "t03-reviewer",
+      "type": "Human",
+      "display_name": "T03 reviewer",
+      "organization_relation": "ServiceProvider",
+      "groups": ["net-kingdom-admins"],
+      "claims": {
+        "assurance": "aal2",
+        "principal_type_source": "authentication-derived",
+        "tenant_source": "registration-supplied"
+      }
+    }
+  ],
+  "resources": []
+}