Adapt USER-WP-0021 and USER-WP-0023 to published policy-nexus contracts

IAM Profile v0.3 and Tenancy Posture v0.1 are now live on
policy.coulomb.social. Close the portal expansion workplan against those
documents, keep the flex-auth live A2 probe waiting, and forward optional
tenant_roles to flex-auth without authorizing from them locally.

tests/test_platform_adapters.py

@@ -37,6 +37,7 @@ class PlatformAdapterTests(unittest.TestCase):
         request = json.loads(call.call_args.args[0].data)
         self.assertEqual(request["resource"]["system"], "user-engine")
         self.assertEqual(request["context"]["self"], True)
+        self.assertEqual(request["subject"]["attributes"]["tenant_roles"], ["CUS"])
 
     def test_flex_auth_fails_closed_when_unavailable(self):
         with patch("user_engine.adapters.flex_auth.urlopen", side_effect=URLError("down")):
@@ -155,7 +156,7 @@ def _request():
     actor = Actor(
         issuer="https://issuer", subject="subject-1", tenant="tenant-a",
         principal_type=PrincipalType.HUMAN, audience=("user-engine",),
-        roles=("tenant-admin",),
+        roles=("tenant-admin",), tenant_roles=("CUS",),
     )
     return AuthorizationRequest(
         actor=actor, resource_type="user-engine:user", resource_id="user-1",

tests/test_verified_claims.py

@@ -23,6 +23,12 @@ class VerifiedIdentityClaimsAdapterTests(unittest.TestCase):
         actor = self.adapter.normalize(self.claims)
         self.assertEqual("person-1", actor.subject)
         self.assertEqual(("tenant-admin",), actor.roles)
+        self.assertEqual((), actor.tenant_roles)
+
+    def test_optional_tenant_roles_are_preserved_without_local_authorization(self):
+        actor = self.adapter.normalize({**self.claims, "tenant_roles": ["CUS", "VEN"]})
+        self.assertEqual(("CUS", "VEN"), actor.tenant_roles)
+        self.assertEqual(("tenant-admin",), actor.roles)
 
     def test_rejects_wrong_issuer_and_audience(self):
         with self.assertRaises(ValidationError):