Make undeclared policy attribute reads a validate error.

FLEX-WP-0025-T03: flex-auth validate flags input.*.attributes keys that
no sibling registry or manifest supplies. A broken testdata package
proves tests can pass while the ceiling remains caller-only.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

internal/policy/testdata/undeclared-ceiling/registry_snapshot.json

@@ -0,0 +1,26 @@
+{
+  "systems": [
+    {
+      "id": "testdata",
+      "name": "Undeclared ceiling fixture"
+    }
+  ],
+  "resource_manifests": [
+    {
+      "id": "testdata-secrets",
+      "system": "testdata",
+      "resources": [
+        {
+          "id": "secret:example",
+          "type": "secret",
+          "attributes": {
+            "actor_id": "example"
+          }
+        }
+      ]
+    }
+  ],
+  "subjects": [],
+  "groups": [],
+  "relationships": []
+}