feat(authz): bind decisions to exact actions

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81

examples/caring/decision_envelope.json

@@ -16,6 +16,25 @@
     "type": "Human",
     "tenant": "tenant:alpha"
   },
+  "binding": {
+    "tenant": "tenant:alpha",
+    "subject": {
+      "id": "user:alice",
+      "type": "Human",
+      "tenant": "tenant:alpha"
+    },
+    "action": "read",
+    "resource": {
+      "id": "document:internal-note",
+      "type": "document",
+      "system": "markitect-tool",
+      "tenant": "tenant:alpha"
+    },
+    "context": {
+      "purpose": "project-delivery"
+    },
+    "request_digest": "sha256:76ddf09170fc5ac49fb58aa9a6f5fb25bf1eb68b969254553979eb1ee0f15fab"
+  },
   "obligations": [
     {
       "type": "log_access",