NK-WP-0054-T03b: declarations and validator migrated to canon grants (draft-3)

Schema, validator, fixtures, declarations and tests (40 pass) now use the imported
principal_type and authority grants MODE @ SCOPE with activation and environments,
estate conventions bind and service-admin, unknown placeholders, and an elimination
path on every exception. SI-4 and SI-7 became decidable. Before/after over the same
declarations: 1/11/2/5/6 to 1/10/2/5/7 (non-conformant/unknown/excepted/planned/
conformant); the only move is KeyCape's secrets-engine-openbao client, whose scope is
established. lldap/admin is now also excepted under SI-4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed

tools/service-identity/declarations/postgresql.yaml

@@ -9,9 +9,11 @@ attestation:
 complete: false
 identities:
   - name: privacyidea
-    classes: [infrastructure]
-    purpose: "Owner of privacyidea_db in the net-kingdom-pg cluster"
-    privilege_level: write_scoped
+    principal_type: SERVICE
+    purpose: "Database role owning privacyidea_db in the net-kingdom-pg cluster"
+    grants:
+      - {mode: USE, scope: privacyidea_db, activation: STANDING, environments: [PRODUCTION]}
+      - {mode: ADMINISTER, scope: privacyidea_db, activation: STANDING, environments: [PRODUCTION], note: "database owner"}
     interactive_login: false
     second_factor: not_applicable
     custody: [delivered-secret]