fix: compare structured binding fields, not a digest we cannot reproduce

The live proof in 03c0569 showed validate_decision_envelope rejecting every
real allow. The evaluator normalizes before hashing -- the request tenant is
copied onto subject and resource, and a registry hit copies type, tenant and
selected attributes onto the refs -- so binding.request_digest covers
material we never sent. Byte-equality against our unenriched request was
unsatisfiable, not merely mismatched.

THE RULE WAS ALREADY PUBLISHED. flex-auth's canonical-request-digest.md
section "Normalization" states the enrichment and tells consumers what to do
instead: compare structured binding fields to the proposed action, treat
request_digest as the evaluator's statement of what it hashed, and recompute
independently over the tuple the binding carries. I raised this with them as
an unpublished gap and asked them to pick between three shapes; it was in
their contract already and the answer was the first of the three. Nothing
was blocked on them, and this follows the published rule rather than one I
inferred.

- _require_binding_corresponds: everything we proposed must survive
  unchanged -- tenant, action, context, subject.id/type,
  resource.id/type/system, and every attribute we sent.
- Enrichment may add only type, tenant, attributes. Any other added field is
  refused, and an enriched tenant must be the request tenant, so a
  cross-tenant binding cannot arrive wearing our request's clothes.
- request_digest is still verified, now against binding_tuple(binding) for
  self-consistency rather than against material we never sent.
- The envelope's top-level subject/resource get the same rule; they are
  enriched too.

Proved against the artifact: the real decision:0f9c98f14545c42d now
validates, and the unrefreshed envelope is refused on lifetime -- reaching
the lifetime check at all is the evidence the binding checks pass on a real
decision. Negatives cover a restated resource.attributes.stage, a foreign
subject.tenant, and an unexpected enrichment field.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E4tNMAYcSQmZWUE4wqP4ij

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 715726@bnt-lap001
Assistant-Session: 80a42b32-cba6-4b23-8be0-68819b1a6092

tests/test_action_authorization.py

@@ -135,7 +135,7 @@ def test_state_hub_authority_is_no_longer_required():
     [
         (lambda d: d.update(effect="deny"), "effect is not allow"),
         (lambda d: d.update(effect="audit_only"), "effect is not allow"),
-        (lambda d: d["binding"].update(action="destroy"), "binding does not match"),
+        (lambda d: d["binding"].update(action="destroy"), "binding action does not match"),
         (lambda d: d["binding"].update(request_digest="sha256:" + "0" * 64),
          "request digest does not match"),
         (lambda d: d["provenance"].update(policy_package="other.package"),
@@ -144,7 +144,15 @@ def test_state_hub_authority_is_no_longer_required():
          "policy version is not accepted"),
         (lambda d: d.update(contract_version="flex-auth.decision-record.v2"),
          "contract version"),
-        (lambda d: d["subject"].update(id="user:mallory"), "subject does not match"),
+        (lambda d: d["subject"].update(id="user:mallory"),
+         "subject.id does not match"),
+        # Enrichment may add attributes; it may never restate what we sent.
+        (lambda d: d["binding"]["resource"]["attributes"].update(stage="build"),
+         "resource.attributes.stage does not match"),
+        (lambda d: d["binding"]["subject"].update(tenant="tenant:coulomb"),
+         "subject.tenant 'tenant:coulomb' is not the request tenant"),
+        (lambda d: d["binding"]["subject"].update(surprise="x"),
+         "carries unexpected field"),
     ],
 )
 def test_invalid_envelopes_fail_closed(mutation, match):