Bind platform OpenBao service identity to tenant zero

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e324-abce-7e51-bb2b-496f097afdb0

tests/test_service_auth.py

@@ -30,7 +30,7 @@ def _jwt(**overrides):
         "iat": now,
         "exp": now + 900,
         "principal_type": "service",
-        "tenant": "tenant:coulomb",
+        "tenant": "tenant:platform",
         "roles": ["secrets-engine"],
         "groups": [],
         "scope": "openbao:login",
@@ -68,6 +68,7 @@ def test_preflight_accepts_exact_service_contract_and_renewal_window():
         ({"iss": "https://attacker.test"}, "'iss'"),
         ({"sub": "service:operator"}, "'sub'"),
         ({"aud": "different"}, "'aud'"),
+        ({"tenant": "tenant:coulomb"}, "'tenant'"),
         ({"tenant": "tenant:other"}, "'tenant'"),
         ({"roles": ["admin"]}, "roles"),
         ({"scope": "openbao:login admin"}, "scope"),