fix(secrets-engine): v2 adds the tenant rule v1 never had

secrets-engine.catalog-lane.lifecycle v1 contained no reference to
input.tenant — not in well_formed, not in the denial ladder, not in a
test. A rotate on lane:glas-primary under tenant:coulomb returned allow
against the deployed package (decision:066e629bbf0c0924).

Found while answering glas-harness's tenant-alignment request, which had
asked for wrong-tenant denial evidence. There was none to return.

Three covers failed the same way: every one of the 29 fixtures carried
tenant:platform, so the suite could not report on the field; T02's own
gate named "wrong-tenant deny" and was recorded done unmet; and the
engine hashes tenant into request_digest but never compares it. Four
other published packages carry the branch — this one was the outlier.

v2 adds wrong_tenant above wrong_system, three Rego tests and three
fixtures (28/28, 32/32). The absent-tenant test caught a second defect
in the first draft: a bare input.tenant != comparison is undefined on a
missing key, so the branch dropped and the ladder reported the wrong
rung. request_tenant := object.get(input, "tenant", "") fixes it.

v2 supersedes rather than amends v1 because the defect failed open: a
consumer pinned to _VERSION=v1 would keep receiving allows with no
signal the rule beneath the version string had changed. The earlier
dual-control correction stayed at v1 because it denied everything.

Replay envelopes regenerated at v2; both request_digest values are
byte-identical, so secrets-engine's digest join needs no re-pinning.

The sweep this prompted found tenant-engine unscoped on tenant as well —
deployed, and verified allowing tenant:coulomb. Not the same fix: its
request tenant names the target rather than the caller, so a constant
would break it. Recorded and carried by FLEX-WP-0022 rather than patched
unilaterally.

FLEX-WP-0021 closes at T05; the pin still serves v1 until a redeploy.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014aQMM1dPXaPiXVn6DwwtLd

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 715613@bnt-lap001
Assistant-Session: fabd95c1-4c9e-4080-8849-8707ae025f80

SCOPE.md

@@ -114,6 +114,22 @@ cross-system object is documented in
 `schemas/action_authorization.schema.json` and is not yet a deployed
 `approval-engine` endpoint.
 
+**secrets-engine is a shipped consumer as of 2026-09-06** (`FLEX-WP-0021`):
+`secrets-engine.catalog-lane.lifecycle` v2 over `resource.type:
+secret-catalog-lane`, twelve actions delivered by secrets-engine rather than
+inferred, `destroy` gated on a dual-control approval claim, and a dedicated
+`flex-auth-secrets-engine` pin at
+`http://flex-auth-secrets-engine.flex-auth.svc.cluster.local:8080` with
+`callerAuth.mode: warn`. Adoption is not complete: secrets-engine is a CLI
+rather than a workload, and the pin's default-deny ingress admits a pod, so an
+operator-run access path is still undecided.
+
+v1 of that package **had no tenant rule and allowed a foreign tenant**; v2
+supersedes rather than amends it, because a fail-open correction must be visible
+to a consumer as a version change (`FLEX-DEC-2026-008`). The sweep that finding
+prompted shows `tenant-engine` unscoped on tenant as well, carried by
+`FLEX-WP-0022`.
+
 The **first shipped protected-system consumer is ops-warden**: its opt-in
 pre-sign gate calls `POST /v1/check` for `resource.type: ssh-certificate`,
 `action: sign` decisions (`examples/ops-warden/`, policy package, allow/deny