fix(secrets-engine): v2 adds the tenant rule v1 never had

secrets-engine.catalog-lane.lifecycle v1 contained no reference to
input.tenant — not in well_formed, not in the denial ladder, not in a
test. A rotate on lane:glas-primary under tenant:coulomb returned allow
against the deployed package (decision:066e629bbf0c0924).

Found while answering glas-harness's tenant-alignment request, which had
asked for wrong-tenant denial evidence. There was none to return.

Three covers failed the same way: every one of the 29 fixtures carried
tenant:platform, so the suite could not report on the field; T02's own
gate named "wrong-tenant deny" and was recorded done unmet; and the
engine hashes tenant into request_digest but never compares it. Four
other published packages carry the branch — this one was the outlier.

v2 adds wrong_tenant above wrong_system, three Rego tests and three
fixtures (28/28, 32/32). The absent-tenant test caught a second defect
in the first draft: a bare input.tenant != comparison is undefined on a
missing key, so the branch dropped and the ladder reported the wrong
rung. request_tenant := object.get(input, "tenant", "") fixes it.

v2 supersedes rather than amends v1 because the defect failed open: a
consumer pinned to _VERSION=v1 would keep receiving allows with no
signal the rule beneath the version string had changed. The earlier
dual-control correction stayed at v1 because it denied everything.

Replay envelopes regenerated at v2; both request_digest values are
byte-identical, so secrets-engine's digest join needs no re-pinning.

The sweep this prompted found tenant-engine unscoped on tenant as well —
deployed, and verified allowing tenant:coulomb. Not the same fix: its
request tenant names the target rather than the caller, so a constant
would break it. Recorded and carried by FLEX-WP-0022 rather than patched
unilaterally.

FLEX-WP-0021 closes at T05; the pin still serves v1 until a redeploy.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014aQMM1dPXaPiXVn6DwwtLd

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 715613@bnt-lap001
Assistant-Session: fabd95c1-4c9e-4080-8849-8707ae025f80

examples/secrets-engine/policy_fixtures.yaml

@@ -1057,5 +1057,125 @@
       "effect": "deny",
       "reason": "wrong_resource_type"
     }
+  },
+  {
+    "id": "fixture:secrets-engine-wrong-tenant-deny",
+    "request": {
+      "id": "check:secrets-engine-wrong-tenant",
+      "tenant": "tenant:coulomb",
+      "subject": {
+        "id": "secrets-engine",
+        "type": "service"
+      },
+      "action": "rotate",
+      "resource": {
+        "id": "lane:glas-primary",
+        "type": "secret-catalog-lane",
+        "system": "secrets-engine",
+        "attributes": {
+          "stage": "prod",
+          "fields": [
+            "password"
+          ],
+          "policy_targets": [],
+          "auth_targets": []
+        }
+      },
+      "context": {}
+    },
+    "expect": {
+      "effect": "deny",
+      "reason": "wrong_tenant"
+    }
+  },
+  {
+    "id": "fixture:secrets-engine-absent-tenant-deny",
+    "request": {
+      "id": "check:secrets-engine-absent-tenant",
+      "subject": {
+        "id": "secrets-engine",
+        "type": "service"
+      },
+      "action": "rotate",
+      "resource": {
+        "id": "lane:glas-primary",
+        "type": "secret-catalog-lane",
+        "system": "secrets-engine",
+        "attributes": {
+          "stage": "prod",
+          "fields": [
+            "password"
+          ],
+          "policy_targets": [],
+          "auth_targets": []
+        }
+      },
+      "context": {}
+    },
+    "expect": {
+      "effect": "deny",
+      "reason": "wrong_tenant"
+    }
+  },
+  {
+    "id": "fixture:secrets-engine-wrong-tenant-with-valid-claim-deny",
+    "request": {
+      "id": "check:secrets-engine-wrong-tenant-dual-control",
+      "tenant": "tenant:coulomb",
+      "subject": {
+        "id": "secrets-engine",
+        "type": "service"
+      },
+      "action": "destroy",
+      "resource": {
+        "id": "lane:glas-primary",
+        "type": "secret-catalog-lane",
+        "system": "secrets-engine",
+        "attributes": {
+          "stage": "prod",
+          "fields": [],
+          "policy_targets": [],
+          "auth_targets": []
+        }
+      },
+      "context": {
+        "approval": {
+          "schema_version": "0.1",
+          "kind": "approval-claim",
+          "issuer": "approval-engine",
+          "approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
+          "state": "valid",
+          "valid_now": true,
+          "consumed": false,
+          "binding": {
+            "action": "secrets.kv.destroy",
+            "target": {
+              "id": "lane-openbao-root",
+              "stage": "prod"
+            },
+            "actor": "agt-secrets-engine",
+            "principal": "bernd",
+            "purpose": "rotate-exposed-key",
+            "digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
+            "pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
+            "pdp_path": true
+          },
+          "freshness": {
+            "observed_at": "2026-09-06T12:00:00+00:00",
+            "ttl_seconds": 30,
+            "not_after": "2026-09-06T12:00:30+00:00"
+          },
+          "validity": {
+            "not_before": "2026-09-06T11:00:00+00:00",
+            "expires_at": "2026-09-06T15:00:00+00:00"
+          },
+          "reason_code": "ok"
+        }
+      }
+    },
+    "expect": {
+      "effect": "deny",
+      "reason": "wrong_tenant"
+    }
   }
 ]