fix: bind approval consumption to actual Flex Auth submissions

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/fixtures/flex-auth-replay/check_request_allow_destroy_dual_control.json

@@ -0,0 +1,54 @@
+{
+  "id": "check:secrets-engine-destroy",
+  "tenant": "tenant:platform",
+  "subject": {
+    "id": "secrets-engine",
+    "type": "service"
+  },
+  "action": "destroy",
+  "resource": {
+    "id": "lane:glas-primary",
+    "type": "secret-catalog-lane",
+    "system": "secrets-engine",
+    "attributes": {
+      "stage": "prod",
+      "fields": [],
+      "policy_targets": [],
+      "auth_targets": []
+    }
+  },
+  "context": {
+    "approval": {
+      "schema_version": "0.1",
+      "kind": "approval-claim",
+      "issuer": "approval-engine",
+      "approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
+      "state": "valid",
+      "valid_now": true,
+      "consumed": false,
+      "binding": {
+        "action": "secrets.kv.destroy",
+        "target": {
+          "id": "lane-openbao-root",
+          "stage": "prod"
+        },
+        "actor": "agt-secrets-engine",
+        "principal": "bernd",
+        "purpose": "rotate-exposed-key",
+        "digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
+        "pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
+        "pdp_path": true
+      },
+      "freshness": {
+        "observed_at": "2026-09-06T12:00:00+00:00",
+        "ttl_seconds": 30,
+        "not_after": "2026-09-06T12:00:30+00:00"
+      },
+      "validity": {
+        "not_before": "2026-09-06T11:00:00+00:00",
+        "expires_at": "2026-09-06T15:00:00+00:00"
+      },
+      "reason_code": "ok"
+    }
+  }
+}