Authorize tenant-engine guardrail read and set actions

FLEX-WP-0014. Package tenant-engine.write-api.mutate v1 now carries
nine actions: tenant.guardrail.read and tenant.guardrail.set on
resource type guardrail, verbatim from tenant-engine's mapping.

The read/write split is used now: flex-auth may read ceilings and is
denied action_not_granted on set; tenant-engine may do both. 17/17
Rego tests and 23/23 fixtures pass. Live e2e against a real
tenant-engine FlexAuthWriteAuthorizer matches.

In source only; production still serves the seven-action 9320df39 pin.

examples/tenant-engine/subject_manifest.yaml

@@ -11,17 +11,39 @@ subjects:
       - Operator
     groups:
       - group:tenant-engine-writers
+      - group:tenant-engine-readers
     tenant: tenant:platform
     metadata:
       description: >-
-        tenant-engine's own service identity, used for the seven write-API
+        tenant-engine's own service identity, used for the nine write-API
         actions it sends to POST /v1/check
         (authz.FlexAuthWriteAuthorizer): tenant.create, tenant.role.grant,
-        tenant.role.revoke, tenant.plan.assign, and the lifecycle actions
-        tenant.update, tenant.retire, tenant.reactivate.
+        tenant.role.revoke, tenant.plan.assign, the lifecycle actions
+        tenant.update, tenant.retire, tenant.reactivate, and the
+        guardrail actions tenant.guardrail.read, tenant.guardrail.set.
+  - id: flex-auth
+    type: Service
+    display_name: flex-auth service principal
+    organization_relation: ServiceProvider
+    roles:
+      - Operator
+    groups:
+      - group:tenant-engine-readers
+    tenant: tenant:platform
+    metadata:
+      description: >-
+        flex-auth's own service identity. Authorized only for
+        tenant.guardrail.read so the PDP can consume ceilings without
+        being able to change them (FLEX-WP-0014).
 groups:
   - id: group:tenant-engine-writers
     display_name: tenant-engine Write API Callers
     members:
       - tenant-engine
     tenant: tenant:platform
+  - id: group:tenant-engine-readers
+    display_name: tenant-engine Guardrail Readers
+    members:
+      - flex-auth
+      - tenant-engine
+    tenant: tenant:platform