Implement USER-WP-0024 security layer conformance

Declare Engine/PIP machine-readably, publish a total fail-closed PEP
stance map, stop minting local decision ids on engine-unavailable DENY,
bind allows to a 30s request lifetime, confine the local authorization
double, classify evidence and emit a denial/revocation heartbeat, and
prove access-control facts remain claims.

Assistant: grok
Assistant-Session: 01a04cea-f0d6-7ab3-9ffd-881eb6bea6cb

src/user_engine/testing/fixtures.py

@@ -61,7 +61,7 @@ class StaticAuthorizationCheckPort:
 
     def check(self, request: AuthorizationRequest) -> AuthorizationDecision:
         self.requests.append(request)
-        return AuthorizationDecision(effect=self.effect, reason="fixture")
+        return AuthorizationDecision.for_standalone(self.effect, reason="fixture")
 
     def batch_check(
         self, requests: Iterable[AuthorizationRequest]

src/user_engine/testing/scenarios.py

@@ -125,8 +125,8 @@ class ScenarioAuthorizationHarness:
         effect = self.action_effects.get(request.action, self.default_effect)
         if _cross_tenant_denied(request) or _assurance_denied(request):
             effect = AuthorizationEffect.DENY
-        return AuthorizationDecision(
-            effect=effect,
+        return AuthorizationDecision.for_standalone(
+            effect,
             reason="scenario",
             obligations=self.action_obligations.get(request.action, ()),
         )