Adapt USER-WP-0021 and USER-WP-0023 to published policy-nexus contracts

IAM Profile v0.3 and Tenancy Posture v0.1 are now live on
policy.coulomb.social. Close the portal expansion workplan against those
documents, keep the flex-auth live A2 probe waiting, and forward optional
tenant_roles to flex-auth without authorizing from them locally.

src/user_engine/adapters/claims.py

@@ -32,6 +32,7 @@ class VerifiedIdentityClaimsAdapter:
             principal_type=PrincipalType(str(claims["principal_type"])),
             audience=audience,
             roles=_strings(claims.get("roles", ())),
+            tenant_roles=_strings(claims.get("tenant_roles", ())),
             groups=_strings(claims.get("groups", ())),
             scopes=_strings(scopes),
             assurance=dict(claims.get("assurance", {})),

src/user_engine/adapters/flex_auth.py

@@ -39,6 +39,7 @@ class FlexAuthHTTPAdapter:
                 "attributes": {
                     "issuer": request.actor.issuer,
                     "roles": list(request.actor.roles),
+                    "tenant_roles": list(request.actor.tenant_roles),
                     "groups": list(request.actor.groups),
                     "scopes": list(request.actor.scopes),
                     "assurance": dict(request.actor.assurance),

src/user_engine/domain/models.py

@@ -210,6 +210,7 @@ class Actor:
     principal_type: PrincipalType
     audience: tuple[str, ...]
     roles: tuple[str, ...] = ()
+    tenant_roles: tuple[str, ...] = ()
     groups: tuple[str, ...] = ()
     scopes: tuple[str, ...] = ()
     assurance: Mapping[str, Any] = field(default_factory=dict)

src/user_engine/testing/fixtures.py

@@ -38,6 +38,7 @@ class FixtureIdentityClaimsAdapter:
             principal_type=PrincipalType(str(claims["principal_type"])),
             audience=tuple(_as_tuple(claims.get("aud", ()))),
             roles=tuple(_as_tuple(claims.get("roles", ()))),
+            tenant_roles=tuple(_as_tuple(claims.get("tenant_roles", ()))),
             groups=tuple(_as_tuple(claims.get("groups", ()))),
             scopes=tuple(_as_tuple(scopes)),
             assurance=dict(claims.get("assurance", {})),