Authorize tenant-engine guardrail read and set actions

FLEX-WP-0014. Package tenant-engine.write-api.mutate v1 now carries
nine actions: tenant.guardrail.read and tenant.guardrail.set on
resource type guardrail, verbatim from tenant-engine's mapping.

The read/write split is used now: flex-auth may read ceilings and is
denied action_not_granted on set; tenant-engine may do both. 17/17
Rego tests and 23/23 fixtures pass. Live e2e against a real
tenant-engine FlexAuthWriteAuthorizer matches.

In source only; production still serves the seven-action 9320df39 pin.

examples/tenant-engine/registry_snapshot.json

@@ -37,6 +37,17 @@
           "metadata": {
             "description": "A tenant's plan/subscription assignment (by reference id)."
           }
+        },
+        {
+          "name": "guardrail",
+          "scope_level": "Resource",
+          "planes": [
+            "Policy",
+            "Audit"
+          ],
+          "metadata": {
+            "description": "A tenant's resolved ceiling (spend, seats, and similar limits) plus the provenance of that value. Not an entitlement and not a meter."
+          }
         }
       ],
       "actions": [
@@ -162,6 +173,40 @@
           "metadata": {
             "required_context": []
           }
+        },
+        {
+          "name": "tenant.guardrail.read",
+          "capabilities": [
+            "View",
+            "Audit"
+          ],
+          "planes": [
+            "Policy",
+            "Audit"
+          ],
+          "exposure_modes": [
+            "Metadata"
+          ],
+          "metadata": {
+            "required_context": []
+          }
+        },
+        {
+          "name": "tenant.guardrail.set",
+          "capabilities": [
+            "EditAny",
+            "Audit"
+          ],
+          "planes": [
+            "Policy",
+            "Audit"
+          ],
+          "exposure_modes": [
+            "Metadata"
+          ],
+          "metadata": {
+            "required_context": []
+          }
         }
       ],
       "caring_profiles": [
@@ -190,11 +235,28 @@
         "Operator"
       ],
       "groups": [
-        "group:tenant-engine-writers"
+        "group:tenant-engine-writers",
+        "group:tenant-engine-readers"
       ],
       "tenant": "tenant:platform",
       "metadata": {
-        "description": "tenant-engine's own service identity, used for the seven write-API actions it sends to POST /v1/check (authz.FlexAuthWriteAuthorizer): tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign, and the lifecycle actions tenant.update, tenant.retire, tenant.reactivate."
+        "description": "tenant-engine's own service identity, used for the nine write-API actions it sends to POST /v1/check (authz.FlexAuthWriteAuthorizer): tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign, the lifecycle actions tenant.update, tenant.retire, tenant.reactivate, and the guardrail actions tenant.guardrail.read, tenant.guardrail.set."
+      }
+    },
+    {
+      "id": "flex-auth",
+      "type": "Service",
+      "display_name": "flex-auth service principal",
+      "organization_relation": "ServiceProvider",
+      "roles": [
+        "Operator"
+      ],
+      "groups": [
+        "group:tenant-engine-readers"
+      ],
+      "tenant": "tenant:platform",
+      "metadata": {
+        "description": "flex-auth's own service identity. Authorized only for tenant.guardrail.read so the PDP can consume ceilings without being able to change them (FLEX-WP-0014)."
       }
     }
   ],
@@ -206,6 +268,15 @@
         "tenant-engine"
       ],
       "tenant": "tenant:platform"
+    },
+    {
+      "id": "group:tenant-engine-readers",
+      "display_name": "tenant-engine Guardrail Readers",
+      "members": [
+        "flex-auth",
+        "tenant-engine"
+      ],
+      "tenant": "tenant:platform"
     }
   ],
   "relationships": []