Implement USER-WP-0024 security layer conformance

Declare Engine/PIP machine-readably, publish a total fail-closed PEP
stance map, stop minting local decision ids on engine-unavailable DENY,
bind allows to a 30s request lifetime, confine the local authorization
double, classify evidence and emit a denial/revocation heartbeat, and
prove access-control facts remain claims.

Assistant: grok
Assistant-Session: 01a04cea-f0d6-7ab3-9ffd-881eb6bea6cb

tests/test_platform_adapters.py

@@ -44,6 +44,8 @@ class PlatformAdapterTests(unittest.TestCase):
             decision = FlexAuthHTTPAdapter(base_url="http://flex-auth").check(_request())
         self.assertEqual(decision.effect, AuthorizationEffect.DENY)
         self.assertEqual(decision.reason, "authorization service unavailable")
+        self.assertIsNone(decision.decision_id)
+        self.assertEqual(decision.stance_applied, "fail_closed")
 
     def test_flex_auth_reads_rotating_caller_token_for_each_decision(self):
         with tempfile.NamedTemporaryFile(mode="w+", encoding="utf-8") as token_file: