Make undeclared policy attribute reads a validate error.

FLEX-WP-0025-T03: flex-auth validate flags input.*.attributes keys that
no sibling registry or manifest supplies. A broken testdata package
proves tests can pass while the ceiling remains caller-only.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

internal/policy/testdata/undeclared-ceiling/policy_fixtures.yaml

@@ -0,0 +1,14 @@
+- id: fixture:undeclared-ceiling-allow
+  request:
+    subject:
+      id: user:alice
+    action: sign
+    resource:
+      id: secret:example
+      attributes:
+        max_ttl_hours: 8
+    context:
+      ttl_hours: 1
+  expect:
+    effect: allow
+    reason: ttl_ok

internal/policy/testdata/undeclared-ceiling/policy_package.md

@@ -0,0 +1,55 @@
+---
+id: testdata.undeclared-ceiling
+name: deliberately undeclared ceiling key
+namespace: testdata:secret
+version: v1
+status: fixture
+package: flexauth.testdata.undeclared_ceiling
+actions:
+  - sign
+owner: team:platform-security
+fixtures:
+  - policy_fixtures.yaml
+caring:
+  profile: caring-0.4.0-rc2
+  enforce: false
+  canonical_roles: [Operator]
+  organization_relations: [ServiceProvider]
+  scopes:
+    - {level: Platform, id: platform:testdata, tenant: tenant:platform}
+  planes: [Secret]
+  capabilities: [Use]
+  exposure_modes: [Metadata]
+  conditions: [Logged]
+  restrictions: [PrivilegeEscalationBlocked]
+---
+
+# Undeclared ceiling (FLEX-WP-0025-T03)
+
+This package exists to prove `flex-auth validate` flags a ceiling read from a
+key the sibling registry never supplies. Do not copy it.
+
+```rego
+import future.keywords.if
+
+default decision := {"effect": "deny", "reason": "no_matching_rule"}
+
+decision := {"effect": "allow", "reason": "ttl_ok"} if {
+  input.action == "sign"
+  input.context.ttl_hours <= input.resource.attributes.max_ttl_hours
+}
+```
+
+```rego test
+package flexauth.testdata.undeclared_ceiling_test
+import future.keywords.if
+import data.flexauth.testdata.undeclared_ceiling
+
+test_allow if {
+  undeclared_ceiling.decision.effect == "allow" with input as {
+    "action": "sign",
+    "context": {"ttl_hours": 1},
+    "resource": {"attributes": {"max_ttl_hours": 8}}
+  }
+}
+```

internal/policy/testdata/undeclared-ceiling/registry_snapshot.json

@@ -0,0 +1,26 @@
+{
+  "systems": [
+    {
+      "id": "testdata",
+      "name": "Undeclared ceiling fixture"
+    }
+  ],
+  "resource_manifests": [
+    {
+      "id": "testdata-secrets",
+      "system": "testdata",
+      "resources": [
+        {
+          "id": "secret:example",
+          "type": "secret",
+          "attributes": {
+            "actor_id": "example"
+          }
+        }
+      ]
+    }
+  ],
+  "subjects": [],
+  "groups": [],
+  "relationships": []
+}