Make undeclared policy attribute reads a validate error.

FLEX-WP-0025-T03: flex-auth validate flags input.*.attributes keys that
no sibling registry or manifest supplies. A broken testdata package
proves tests can pass while the ceiling remains caller-only.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

internal/policy/testdata/undeclared-ceiling/policy_fixtures.yaml

@@ -0,0 +1,14 @@
+- id: fixture:undeclared-ceiling-allow
+  request:
+    subject:
+      id: user:alice
+    action: sign
+    resource:
+      id: secret:example
+      attributes:
+        max_ttl_hours: 8
+    context:
+      ttl_hours: 1
+  expect:
+    effect: allow
+    reason: ttl_ok