feat: bind the destroy gate to approval_binding_digest and pdp_path

The vocabulary mapping this path was waiting on is not coming: gate-house
rejected it in GH-DEC-2026-008, because a translation can be confidently
wrong and fails open by accepting a claim approved for a different action.
The stronger option arrived instead, and both halves are enforced here.

flex-auth published binding.approval_binding_digest (FLEX-DEC-2026-007) to
fix the circularity this repo reported: a pdp_digest recorded at issue time
can never equal the request_digest of the request that carries the claim in
its hashed context, so with GH-DEC-2026-008 requiring that equality, destroy
would have failed closed forever on a check no correct record could pass.

- authorization.approval_binding_digest implements the published exclusion
  rule, including Go's context,omitempty behaviour when stripping empties
  the context; digest_material drops an empty context for the same reason.
- validate_decision_envelope recomputes the field rather than trusting it,
  refuses a claim-bearing request whose decision records none, and compares
  the claim's digest from step 1 against it -- never against request_digest,
  which still covers the claim so it stays a sound replay identity.
- validate_approval_claim requires binding.pdp_path true before using
  pdp_digest at all. Path intent is never inferred from a digest that
  happens to be present; pre-schema-v3 approvals carry pdp_path false
  regardless of any digest they hold.

Replay fixtures re-vendored from dd3ce4c. The destroy pins moved a second
and final time; approval_binding_digest did not, which is the point. The
fixture now demonstrates the property instead of asserting it: we rederive
fa07becf... from its own request through our canonical implementation,
proving we hash the same material flex-auth does rather than pinning a
constant we cannot reproduce.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E4tNMAYcSQmZWUE4wqP4ij

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 715726@bnt-lap001
Assistant-Session: 80a42b32-cba6-4b23-8be0-68819b1a6092

tests/test_consume_binding_join.py

@@ -84,6 +84,7 @@ def _served(entry=None, action="deactivate", fields=("api_token",), **over):
             # comparison usable today: the native digest speaks
             # approval-engine's vocabulary and no mapping to ours is published.
             "pdp_digest": request_digest(request),
+            "pdp_path": True,
         },
         "freshness": {
             "observed_at": now.strftime("%Y-%m-%dT%H:%M:%SZ"),
@@ -191,6 +192,30 @@ def test_superseded_claim_fails_closed(tmp_path):
         _resolve(_Cfg(_token(tmp_path)), _entry(), _served(valid_now=False, reason_code="superseded"))
 
 
+def test_claim_without_pdp_path_fails_closed(tmp_path):
+    """pdp_path is a declaration, and it is never inferred from a digest.
+
+    approval-engine schema v3 refuses to issue pdp_path true without a
+    pdp_digest, so a true declaration guarantees the digest. The converse does
+    not hold: a digest recorded for some other reason is not a statement that
+    this approval was requested against a bound CheckRequest, and approvals
+    issued before v3 carry pdp_path false regardless of any digest they hold
+    (GH-DEC-2026-008).
+    """
+    claim = _served()
+    claim["binding"]["pdp_path"] = False
+    with pytest.raises(DecisionError, match="does not declare binding.pdp_path"):
+        _resolve(_Cfg(_token(tmp_path)), _entry(), claim)
+
+
+def test_claim_omitting_pdp_path_fails_closed(tmp_path):
+    """An absent declaration is not a true one."""
+    claim = _served()
+    claim["binding"].pop("pdp_path")
+    with pytest.raises(DecisionError, match="does not declare binding.pdp_path"):
+        _resolve(_Cfg(_token(tmp_path)), _entry(), claim)
+
+
 def test_claim_without_pdp_digest_fails_closed_naming_the_missing_mapping(tmp_path):
     """No published vocabulary mapping means the claim cannot be tied to this action.