Reconcile the canonical model and discovery with the runtime

Closes gap G02 of the scope assessment for the client-registration and discovery
surface. spec/canonical-model.yaml and domain/model.go both claimed to be the
source of truth and disagreed: the spec restricted grants to authorization_code,
required redirect URIs of every client, and omitted the audience, service
subject, tenant, role, MFA and handoff fields the runtime reads.

The durable part is the link, not the edit. A two-way conformance test compares
the spec against the Go model by reflection and fails when a runtime field has
no spec entry or a spec entry is not read by the runtime, the latter unless
marked runtime: false. It found drift beyond the assessment's list on its first
run -- User.tenant was undeclared -- which is the argument for the check over a
one-time reconciliation.

Discovery now advertises the core profile claims that appear on every token and
derives scopes_supported from the registered clients rather than a fixed list.

The Go model is stated as the runtime authority and the YAML as the reviewed
contract, in both files. This covers client registration and discovery, not
schema enforcement in general, which remains G06.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6

spec/canonical-model.yaml

@@ -1,8 +1,17 @@
 version: "0.1"
 description: >
   Canonical Identity Model for KeyCape / NetKingdom IAM Profile.
-  This file is the source of truth for all identity entities.
-  All provisioning, tests, and migrations derive from these definitions.
+
+  This file is the reviewed contract for identity entities. The runtime
+  authority is src/internal/domain/model.go: the server reads Go structs, not
+  this YAML. The two are held together by an executable conformance check
+  (src/internal/domain/conformance_test.go, KEY-WP-0017), which fails the build
+  when a runtime field has no entry here or an entry here is not read by the
+  runtime.
+
+  So: change the Go model and this file together. A field declared here but
+  deliberately not implemented must carry `runtime: false`, which is how the
+  check tells a reserved field apart from a forgotten one.
 
 entities:
   User:
@@ -29,6 +38,14 @@ entities:
         type: boolean
         required: true
         description: "Whether the account is active."
+      tenant:
+        type: string
+        required: false
+        description: >
+          NetKingdom IAM Profile tenant claim for this user (e.g.
+          tenant:friendly:binky). Absent falls back to the platform tenant
+          rather than emitting an empty claim, since the profile requires a
+          tenant on every token.
       groups:
         type: array
         items:
@@ -105,9 +122,12 @@ entities:
         items:
           type: string
           format: uri
-        required: true
+        required: false
         minItems: 1
-        description: "Allowed redirect URIs. Wildcards are NEVER permitted."
+        description: >
+          Allowed redirect URIs. Wildcards are NEVER permitted. Required for any
+          client using the authorization_code grant; a client_credentials-only
+          client registers none.
       allowedScopes:
         type: array
         items:
@@ -118,9 +138,11 @@ entities:
         type: array
         items:
           type: string
-          enum: [authorization_code]
+          enum: [authorization_code, client_credentials]
         required: true
-        description: "Allowed OAuth2 grant types. Only authorization_code in v0.1."
+        description: >
+          Allowed OAuth2 grant types. An empty or absent value means
+          authorization_code, which is what config validation assumes.
       clientType:
         type: string
         enum: [confidential, public]
@@ -130,14 +152,61 @@ entities:
         type: string
         nullable: true
         description: "Reference to the client secret (confidential clients only)."
+      audience:
+        type: string
+        nullable: true
+        description: >
+          Static resource audience for access tokens. ID tokens keep the client
+          audience. Absent means the access-token audience is the client ID.
+      serviceSubject:
+        type: string
+        nullable: true
+        description: >
+          Subject claim for client_credentials tokens (e.g. service:secrets-engine).
+          Required together with tenant for that grant.
+      tenant:
+        type: string
+        nullable: true
+        description: >
+          Tenant claim emitted for this client's service tokens. Bound at
+          registration and never influenced by request parameters; see
+          docs/tenant-claim-contract.md.
+      roles:
+        type: array
+        items:
+          type: string
+        description: "Role claims emitted for this client's service tokens."
+      mfaRequired:
+        type: boolean
+        nullable: true
+        description: >
+          Per-client MFA requirement. Absent means the provider default
+          (mandatory MFA); false lowers ordinary login to AAL1 while acr_values
+          can still force step-up.
+      registrationUrl:
+        type: string
+        format: uri
+        nullable: true
+        description: "Registration handoff target for unknown subjects."
+      enrollmentUrl:
+        type: string
+        format: uri
+        nullable: true
+        description: "Factor-enrollment handoff target for unenrolled subjects."
       tokenProfile:
         type: string
-        description: "Optional: token configuration profile name."
+        runtime: false
+        description: >
+          Reserved. Declared for future token configuration profiles; the runtime
+          does not read it.
       environments:
         type: array
         items:
           type: string
-        description: "Environments this client is registered for (e.g. prod, staging)."
+        runtime: false
+        description: >
+          Reserved. Environments this client is registered for (e.g. prod,
+          staging); the runtime does not read it.
 
   Membership:
     description: "Explicit link between a user and a group."