Implement USER-WP-0024 security layer conformance

Declare Engine/PIP machine-readably, publish a total fail-closed PEP
stance map, stop minting local decision ids on engine-unavailable DENY,
bind allows to a 30s request lifetime, confine the local authorization
double, classify evidence and emit a denial/revocation heartbeat, and
prove access-control facts remain claims.

Assistant: grok
Assistant-Session: 01a04cea-f0d6-7ab3-9ffd-881eb6bea6cb

pep-stance.yaml

@@ -0,0 +1,53 @@
+# user-engine — PEP unreachable-engine stance map
+#
+# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md §6.4, §9.3
+# Companion: net-kingdom/SECURITY-COMPANION.md §5
+# Validate:  tests/test_layer_conformance.py
+#
+# user-engine is a PEP-shaped Engine (PIP). Protected mutations proceed only
+# with a decision from access-engine, or under this published stance whose
+# application is recorded in place of a decision.
+#
+# Total by construction: every zone in security-zones_v0.1, plus unknown and
+# not-applicable. No implicit default. Production is fail-closed everywhere,
+# including unknown.
+
+schema_version: "0.1"
+framework: netkingdom-security-layer-model
+standard_version: "0.7"
+repository: user-engine
+pep_shape: true
+declared_by: INTENT.md
+
+protected_action: "user-engine owned mutations (account, membership, registration, hat, catalog, profile)"
+decision_engine: access-engine
+scope: security-zone
+
+stance:
+  z0-experimental: fail_closed
+  z1-operational: fail_closed
+  z2-protected: fail_closed
+  z2-continuity: fail_closed
+  z3-critical: fail_closed
+  unknown: fail_closed
+  not-applicable: fail_closed
+
+allow_binding: request
+allow_lifetime_seconds: 30
+
+on_apply:
+  recorded_fields:
+    - stance_applied
+    - stance_scope
+    - outcome
+    - decision_id
+  decision_id: present only where access-engine rendered a decision
+  written_to:
+    - "local audit_records (UserEngineService._authorize)"
+  never_recorded: "caller tokens, secret material, profile payloads"
+
+verdict_caching: none
+
+reconstructability:
+  bound: "§9.6 — local audit and outbox prove the records they hold"
+  completeness_claimed: false