fix(relay): scope-gate PDP context headers

[jeremi]

Summary

• require exact-value registry:trust:<field>:<value> scopes before Relay accepts subject, relationship, delegation actor, credential-format, or source-observation headers as PDP context
• exercise the real Relay decision path for all five ticket fields, proving absent and mismatched scopes deny while the exact value scope permits
• add Relay-local redacted audit provenance for the four newly authenticated context fields on Permit and Deny, without changing shared PDP semantics for Notary
• document the complete ten-header trust-context surface, policy-authoring guardrail, protocol requirement, and breaking client impact

Closes #208.

Security review

The platform PDP review confirmed these fields are not universally match-only. Required-context, relationship, credential-format, and freshness policy shapes can use their presence or value on a Permit path. Relay therefore omits every listed header from PDP context unless the authenticated principal carries the exact value-bearing trust scope.

Audit provenance enrichment stays at the Relay boundary after exact-scope validation because other platform PDP consumers do not assign the same trust semantics to these context fields. Decision audits record field names only; tests cover Permit and Deny and prove that raw subject, relationship, delegation, and credential-format values are absent.

No route, static scope, source-read ordering, redaction, error shape, or OpenAPI surface changes. Data-Purpose remains caller-stated purpose context and is explicitly not documented as trust evidence. The mechanical security-invariant checklist passes. A final independent staff review approved the corrected design with no actionable findings.

Validation

• cargo test --locked -p registry-platform-pdp
• cargo test --locked -p registry-notary-server matching_pdp_decision_ --lib
• focused Relay scope-gating and Permit/Deny audit-provenance tests
• cargo test --locked -p registry-relay
• cargo test --locked -p registry-relay --all-features
• cargo check --locked --workspace --all-targets
• workspace clippy and Relay all-feature clippy with -D warnings
• root cargo deny check
• Relay just openapi-contract and Notary just openapi-check
• docs npm test and full npm run check, including current and archived builds plus link validation

The Relay-local deny.toml step in just ci still rejects the workspace-pinned Crosswalk git source and lacks the root advisory ignores. The authoritative root cargo deny check passes; this is the documented pre-existing per-product deny mismatch, not a change from this PR.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 209c2ee377

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".