Reconcile the canonical model and discovery with the runtime

Closes gap G02 of the scope assessment for the client-registration and discovery
surface. spec/canonical-model.yaml and domain/model.go both claimed to be the
source of truth and disagreed: the spec restricted grants to authorization_code,
required redirect URIs of every client, and omitted the audience, service
subject, tenant, role, MFA and handoff fields the runtime reads.

The durable part is the link, not the edit. A two-way conformance test compares
the spec against the Go model by reflection and fails when a runtime field has
no spec entry or a spec entry is not read by the runtime, the latter unless
marked runtime: false. It found drift beyond the assessment's list on its first
run -- User.tenant was undeclared -- which is the argument for the check over a
one-time reconciliation.

Discovery now advertises the core profile claims that appear on every token and
derives scopes_supported from the registered clients rather than a fixed list.

The Go model is stated as the runtime authority and the YAML as the reviewed
contract, in both files. This covers client registration and discovery, not
schema enforcement in general, which remains G06.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6

SCOPE.md

@@ -43,8 +43,11 @@ Keycloak interchangeability are not established.
   current service-identity, audience, tenant/role, MFA and lifetime contract.
   Password and MFA credential migration is not supplied.
 - Snapshot validation is a limited Go rule set, not full machine-readable schema
-  enforcement. The canonical YAML model and discovery metadata lag newer runtime
-  capabilities. The authorization-code grant now binds the redirect URI,
+  enforcement. The canonical YAML model and discovery metadata now match the
+  runtime client-registration surface and are held there by a conformance check
+  (KEY-WP-0017); the Go model is the runtime authority and the YAML the reviewed
+  contract. That is narrower than schema enforcement in general.
+- The authorization-code grant now binds the redirect URI,
   enforces grant-type eligibility, authenticates confidential clients and
   consumes codes atomically, and UserInfo enforces algorithm, issuer and
   access-token purpose (KEY-WP-0016). Upstream provider tokens from Authelia are