Implement TEN-WP-0011 security layer conformance

Engine/PIP declaration is now checkable (layer.yaml plus a Tooling-client
scan). Writes persist a decision record or the published fail-closed
stance, live-lookup freshness is published, events_for is tenant-scoped,
and mutation evidence drains to audit-core from a local outbox without
blocking the mutation.

Sender registration is requested as AUDIT-IN-0002. Boundary-contract
amendment is requested as NET-IN-0002.

Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9

tests/postgres_backend.py

@@ -17,11 +17,12 @@ def clean_postgres_store(tmp_path: Path) -> PostgresTenantStore:
     except ImportError:
         pytest.skip("install tenant-engine[postgres] to exercise PostgreSQL conformance")
 
-    migration = Path(__file__).parents[1] / "migrations/postgres/0001_tenant_store.sql"
+    migrations = Path(__file__).parents[1] / "migrations/postgres"
     with psycopg.connect(dsn, autocommit=True) as connection:
-        connection.execute(migration.read_text(encoding="utf-8"))
+        for path in sorted(migrations.glob("*.sql")):
+            connection.execute(path.read_text(encoding="utf-8"))
         connection.execute(
-            """TRUNCATE guardrail_changes, guardrail_overrides,
+            """TRUNCATE audit_outbox, authz_records, guardrail_changes, guardrail_overrides,
                idempotency_receipts, events, plans, grants, tenants
                RESTART IDENTITY CASCADE"""
         )