Refine SCOPE, add INTENT, fix the GOAL invariant flex-auth rejected

GOAL.md still carried the first-draft invariant — "nothing this repo builds sits
synchronously in a decision path" — after flex-auth's review had rejected it as
a latency guarantee wearing an authority guarantee's clothes. Under that wording
zone-engine could compile enforced: false for a lane, flip warden sign from deny
to allow with no flex-auth policy change, and be literally compliant. Replaced:
identity and membership here, effect in a flex-auth policy package. Compiled-not-
queried is demoted to a consequence of that, which is what it always was.

SCOPE now records what the two reviews settled rather than what was proposed:
separate standard (canon Decision 5.6), membership declared in tenancy.yaml's
reserved zones: key, stance out of scope for controls flex-auth decides, the
fail-open axis modelled PEP-side because a PDP structurally cannot express it,
organization_posture an input rather than a declaration field, and reefs not
ours. Plus the two inherited constraints: the dead trust_zone field already
sitting where membership would go, and flex-auth's lack of a reload path.

INTENT.md states the argument, including what would falsify the repo — the
exception lifecycle not needing a runtime is called out as a legitimate outcome
that should archive this repo rather than keep it for its own sake.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

GOAL.md

@@ -17,9 +17,21 @@ expires on its own.
 
 ## Invariants
 
-- **`flex-auth` remains the only policy decision point.** Zone membership
-  reaches it by compilation into the registry it already consumes. Nothing this
-  repo builds sits synchronously in a decision path.
+- **`flex-auth` remains the only policy decision point.** zone-engine is
+  authority over zone **identity and membership**; the **effect** of a zone on
+  any decision flex-auth renders is expressed in a flex-auth policy package.
+
+  The first draft of this invariant said "nothing this repo builds sits
+  synchronously in a decision path". flex-auth rejected that on review: it is a
+  *latency* guarantee, not an authority one. Compiled data that determines an
+  outcome is still deciding — it just decided earlier. Under the old wording
+  zone-engine could compile `enforced: false` for a lane, flip `warden sign`
+  from deny to allow with no flex-auth policy change, and be literally
+  compliant. Membership is ours; stance is theirs.
+- **Compiled, not queried.** Membership reaches flex-auth by compilation into
+  the registry it already loads. This is a *consequence* of the invariant
+  above, not the invariant itself — flex-auth is `service_class:
+  latency-critical` and loads its registry once at process start.
 - **A zone that can be quietly widened is not a boundary.** Every change of
   stance is observable, and every exception has an enforced expiry.
 - **Accuracy, not altitude** (`tenancy-posture_v0.1` §6). A repo declaring a