docs: answer the GLAS-WP-0015 tenant question and record the DNS hazard

Probing the handed-over Service DNS name from the workstation found that
every *.svc.cluster.local name resolves here to one unrelated public
address via the ad.binect.de search suffix -- including names of services
that do not exist, which proves it is suffix expansion and not a record.

Pointing SECRETS_ENGINE_PDP_URL at the Service name would send the
CheckRequest body (subject, tenant, lane ids, stage, field names, purpose)
and the static Bearer token to that host. Decision envelopes are
structurally validated but not signed, so a responder knowing the package
and version can return a well-formed allow; the fail-closed posture
assumes the PDP is the PDP.

Not mitigated here: choosing the transport control is the owners' call,
not this consumer's. Recommended to FLEX-WP-0021-T05 that the handover be
a trailing-dot FQDN or explicit address, with the response channel's
authentication stated. Our pin stays unset, so the hazard is theoretical.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E4tNMAYcSQmZWUE4wqP4ij

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 715726@bnt-lap001
Assistant-Session: 80a42b32-cba6-4b23-8be0-68819b1a6092

docs/tenant-alignment.md

@@ -115,3 +115,45 @@ alone.
 - A supported owner access path to `flex-auth-secrets-engine` for a workstation
   CLI. Service DNS is not workstation connectivity, so the tenant fix above is
   necessary but not sufficient for activation (`FLEX-WP-0021-T05`).
+
+## Hazard: the Service DNS name resolves here, to the wrong host
+
+Probed from the workstation 2026-09-06. This is worse than "not reachable" and
+is the reason the access path must be handed over explicitly rather than assumed
+from a Service name.
+
+```text
+$ getent hosts flex-auth-secrets-engine.flex-auth.svc.cluster.local
+80.158.43.29   flex-auth-secrets-engine.flex-auth.svc.cluster.local.ad.binect.de
+
+$ getent hosts this-service-does-not-exist.flex-auth.svc.cluster.local
+80.158.43.29   this-service-does-not-exist.flex-auth.svc.cluster.local.ad.binect.de
+
+$ getent hosts flex-auth-secrets-engine.flex-auth.svc.cluster.local.   # trailing dot
+(no resolution)
+```
+
+`/etc/resolv.conf` carries `search ad.binect.de fritz.box`, and `ad.binect.de`
+answers wildcard, so **every** `*.svc.cluster.local` name resolves on this
+workstation to one unrelated public address. A nonexistent service resolves
+identically, which proves it is suffix expansion rather than any real record.
+
+Consequences if `SECRETS_ENGINE_PDP_URL` were pointed at the Service name from a
+workstation:
+
+- The `POST /v1/check` body — subject id/type, tenant, lane/resource ids, stage,
+  declared field names, purpose — would go to an arbitrary internet host. It
+  contains no secret values, but it is a structural map of the estate's
+  credential lanes.
+- The static Bearer token would be sent to that host.
+- Decision envelopes are structurally validated but **not signed**. A responder
+  that knows the package name and version can return a well-formed
+  `effect: allow`, and this engine's checks would pass it. The fail-closed
+  production posture assumes the PDP is the PDP.
+
+This is not fixed here, because choosing the transport control is the owners'
+call, not this consumer's. Recommended for `FLEX-WP-0021-T05`: hand over a
+trailing-dot FQDN or an explicit address, and state the authentication of the
+response channel (mTLS, or a signed envelope) rather than leaving an unsigned
+allow over plaintext HTTP as the contract. This engine keeps its pin unset in
+the meantime, which is why the hazard is currently theoretical.