Reconcile the canonical model and discovery with the runtime

Closes gap G02 of the scope assessment for the client-registration and discovery
surface. spec/canonical-model.yaml and domain/model.go both claimed to be the
source of truth and disagreed: the spec restricted grants to authorization_code,
required redirect URIs of every client, and omitted the audience, service
subject, tenant, role, MFA and handoff fields the runtime reads.

The durable part is the link, not the edit. A two-way conformance test compares
the spec against the Go model by reflection and fails when a runtime field has
no spec entry or a spec entry is not read by the runtime, the latter unless
marked runtime: false. It found drift beyond the assessment's list on its first
run -- User.tenant was undeclared -- which is the argument for the check over a
one-time reconciliation.

Discovery now advertises the core profile claims that appear on every token and
derives scopes_supported from the registered clients rather than a fixed list.

The Go model is stated as the runtime authority and the YAML as the reviewed
contract, in both files. This covers client registration and discovery, not
schema enforcement in general, which remains G06.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6

history/2026-09-05-011726-scope-intent-assessment.md

@@ -113,6 +113,20 @@ and add executable compatibility checks for human and service registrations.
 Distinguish required profile claims from optional discovery metadata rather than
 assuming every omission has the same protocol impact.
 
+**Status 2026-09-07 (KEY-WP-0017): closed for client registration and
+discovery.** The Go model is now stated as the runtime authority and the
+canonical model as the reviewed contract, with a two-way conformance test
+holding them together — it rejects a runtime field with no spec entry and a spec
+field the runtime does not read, the latter unless marked `runtime: false`. The
+check found drift beyond the assessment's list on its first run (`User.tenant`
+was undeclared), which is the argument for the check over the one-time edit. The
+`Client` entity gained the audience, service-subject, tenant, role, MFA and
+handoff fields, `grantTypes` gained `client_credentials`, and `redirectUris` is
+no longer required of service-only clients. Discovery now advertises the core
+profile claims and derives `scopes_supported` from the registered clients.
+Still open: this covers the client-registration and discovery surface, not
+schema enforcement in general, which remains G06.
+
 ### G03 — Migration does not preserve the current authentication contract
 
 **Priority: high. Kind: implementation gap.**