test: expand policy engine security boundary coverage

[man4ish]

Summary

• Added 25 deterministic policy-engine security and boundary tests in tests/test_policy_boundaries_extra.py.
• Covered ABAC precedence, permission resolution, admin behavior, tenancy boundaries, protected-resource rules, request validation, policy-service validation, direct route delegation, application helpers, and pub/sub stream restart behavior.
• External services and infrastructure were not required.

Baseline

• 105 tests collected.
• Deterministic subset: 97 passed, 2 xfailed.
• Full suite hangs in tests/test_routes_policy.py during the FastAPI/Starlette TestClient path.
• Measurable baseline: 69/77 statements/lines (89.61%), 5/8 branches (62.5%), and 5/8 functions (62.5%).
• No configured coverage exclusions.

Verification

• New test file: 25 passed, 0 failed, 0 skipped.
• Deterministic suite: 122 passed, 0 failed, 0 skipped, 2 xfailed.
• Final measurable coverage: 77/77 statements/lines (100%), 8/8 branches (100%), and 8/8 functions (100%).
• Ruff passes for tests/test_policy_boundaries_extra.py.
• No Redis, IAM, network, Docker, or live external services were required.

Coverage attribution limitation

Several policy-core modules are imported from pre-existing compiled Cython .so files. Coverage.py therefore cannot attribute execution of those compiled modules to their adjacent .py sources. No Cython artifacts were rebuilt, replaced, deleted, regenerated, or modified.

Known limitations

• The broader suite remains blocked by the existing hang in tests/test_routes_policy.py; route behavior was tested through direct handler invocation instead.
• No production workaround or test exclusion was introduced.

Security findings retained for follow-up

This PR does not fix production security findings:

1. app/core/permissions.py: required_permission() / evaluate_permission() currently allow unknown actions by treating them as requiring no permission. Unknown actions should fail closed.
2. app/core/engine.py: wildcard action/resource values can pass authorization. Undefined wildcard authorization should fail closed.

Protection

• Production source files modified: 0.
• Generated Cython files modified: 0.
• Coverage configuration modified: 0.
• No coverage exclusions or pragmas added.
• Existing tests were not weakened, skipped, or deleted.

This PR is test-only and is open for review. It must not be merged as part of this task.