fix: bind approval consumption to actual Flex Auth submissions

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/fixtures/flex-auth-replay/check_request_deny_wrong_tenant.json

@@ -0,0 +1,23 @@
+{
+  "id": "check:secrets-engine-wrong-tenant",
+  "tenant": "tenant:coulomb",
+  "subject": {
+    "id": "secrets-engine",
+    "type": "service"
+  },
+  "action": "rotate",
+  "resource": {
+    "id": "lane:glas-primary",
+    "type": "secret-catalog-lane",
+    "system": "secrets-engine",
+    "attributes": {
+      "stage": "prod",
+      "fields": [
+        "password"
+      ],
+      "policy_targets": [],
+      "auth_targets": []
+    }
+  },
+  "context": {}
+}