fix: exclude correlation fields from the flex-auth request digest

Verified the digest join against flex-auth's T03 replay fixtures and found
request_digest was hashing fields docs/canonical-request-digest.md excludes.
The material is tenant, subject, action, resource, context only: id is
correlation, policy_version lives in provenance, caring_context is hashed
separately. This engine included all three when present.

Because the join adopts the served request id, every real production request
would have carried one, so the computed digest would have matched no issued
decision and failed closed against every correct allow. Same unsatisfiable
shape as the removed AUTHORITY constant.

The old pinned constant was computed with the id inside the material, so it
was wrong and its passing proved nothing. Replaced with fixture-driven tests
over two real envelopes (vendored with provenance) plus a structural test
that correlation fields do not move the digest. Both fixtures are needed:
input_claim_digests.context appears only with a non-empty context.

Also stops computing the native claim digest. The claim's binding.action and
binding.target speak approval-engine's vocabulary while ours speaks the
catalog's, and no mapping is published; flex-auth makes no cross-check and
states the correspondence is ours via pdp_digest. A claim recording no
pdp_digest now fails closed naming the missing mapping rather than comparing
two different languages. That mapping is a prerequisite for destroy.

274 tests pass. Production still fails closed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M65ovP3eiiPHubibvWs9mD

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 393550@bnt-lap001
Assistant-Session: 4bb359f9-1f12-4410-9e76-079cf23c82e4

docs/approval-consumption.md

@@ -43,9 +43,28 @@ never compared to each other:
   of `{action, actor, principal, purpose, target}`.
 - `decision.binding.request_digest` — flex-auth canonical CheckRequest digest.
 
-When the issuer recorded `claim.binding.pdp_digest`, that comparison is
-preferred. The CheckRequest mapping onto the claim binding is published in
-`approval-engine/docs/approval-claim.md`.
+`claim.binding.pdp_digest` is the **only** comparison usable today, and its
+absence fails the action closed. The claim's `binding.action` and
+`binding.target` speak approval-engine's vocabulary (`secrets.kv.destroy`,
+`{"id": ..., "stage": ...}`) while ours speaks the catalog's (`destroy`,
+`catalog:<id>`), and no mapping between them is published. flex-auth makes no
+cross-check either and states the correspondence is ours. Computing a native
+digest from our own vocabulary would compare two different languages and never
+match, so this engine does not compute one. Closing that gap needs a published
+mapping co-authored by approval-engine and flex-auth; it is a prerequisite for
+`SECRETS-WP-0007-T04` making `destroy` reachable.
+
+### What is hashed in the flex-auth digest
+
+`tenant`, `subject`, `action`, `resource`, `context` — and nothing else.
+`id` is correlation only, `policy_version` lives in provenance, and
+`caring_context` is hashed separately. Including any of them yields a digest
+that matches no issued decision. `digest_material` enforces the exclusion and
+`tests/test_decision_replay.py` pins it against two real envelopes.
+
+A consumer re-hashing the *original unenriched* request will not match a
+decision that turned on registry attributes: the binding is the evaluator's
+statement of what it hashed, so recompute from the binding tuple.
 
 The approval-engine object id is never inferred from a State Hub decision UUID.
 It comes from catalog `approval.authorization_id`, and is the value in the