test: add policy engine security boundary coverage

[man4ish]

Summary

Added deterministic security-boundary tests for the policy engine.

Verification

• Baseline: 90 tests
• Final collection: 105 tests
• Deterministic suite: 97 passed
• Strict xfails: 2
• New security tests: 10 logical tests passed + 2 documented xfails (13 expanded parameterized cases passed + 2 xfailed)
• Ruff: passed for new test
• Production source modified: 0
• Unexpected failures: 0 in the deterministic suite

Coverage

• Statement coverage: approximately 87%
• Branch coverage: approximately 63%
• Cython .so modules shadow core Python modules and therefore limit the reliability of the raw coverage measurement.

Security behavior covered

• Evaluation precedence
• Short-circuiting
• RBAC
• Permissions
• Tenancy
• ABAC
• Rule denial
• Admin/rule conflicts
• Malformed requests
• Cache corruption
• Cache/backend failures
• Cache-key isolation
• Tenant fail-closed behavior

Documented security defects

The following defects are intentionally preserved and documented through strict xfail tests, without fixing them:

1. Unknown actions currently pass authorization.
2. Wildcard actions/resources do not fail closed.
3. Cache/IAM-style failures propagate exceptions instead of producing structured denial.

These are intentionally preserved for separate production bug-fix work.

Environment limitation

The existing API route tests hang at the first TestClient.post() under the current environment. The complete suite is not claimed as passed, and the route-test hang was not bypassed or fixed.

GitHub CI currently fails during editable-package installation because Cython is unavailable in the isolated build environment; lint and tests are not reached.

Scope

Only tests/test_security_boundaries.py is included. Production source files, generated artifacts, coverage files, caches, Cython files, and unrelated changes are not included.