docs: a Community deployment can refuse a declaration from platform v11

[saurabhjain1592]

From platform v11.0.0, a Community deployment CAN refuse a caller that presents a PEP capability declaration, and two sentences in this SDK say it cannot. Docs only; filed on the ruling on getaxonflow/axonflow-enterprise#3746.

• src/main/java/com/getaxonflow/sdk/types/PEPHandshake.java:27-28 at afdaec66f: "A Community deployment records the declaration and does not deny on it."
• runtime-e2e/pep_handshake_planes/README.md:22 at afdaec66f: "On Community, the declaration is recorded and does not deny."

What the platform does (enterprise 857455033):

• decide passes the admitted declaration's profile into the enforcing seam (platform/agent/decision_handler.go:1304).
• The seam refuses with unsupported_obligation when that profile cannot discharge a mandatory obligation (platform/agent/decision_enforcing_seam.go:1042-1046).
• The Community build passes that refusal through unchanged (platform/agent/pep_handshake_anchored_community.go:10-16).
• Only the capability refusal on an allow, where an allow carrying a mandatory obligation outside the declared set becomes a deny, is Enterprise-only.

Measured live: the Rust SDK's runtime-e2e/pep_handshake_planes leg, refusal phase, on a Community stack running on the app database role, built from enterprise 857455033 (agent image sha256:0b9e3c407e4713191965de236a3ce39f9624b93b0351c52884e85b99ff82d266), SDK commit 992ef8edd. An organization pii=redact detection override was recorded for local-dev-org. Under it, a decide from a client declaring ONLY field_mask@1 was answered verdict: deny, reasons: ["unsupported_obligation"] (decision a74f7483-772c-4187-9165-665aa048f4d7). A client declaring nothing got the same (fd4986ef-005e-43fe-bd65-c23240ea1207), and a client declaring field_redact@1 was allowed with redact_pii (ce23fee9-a370-4351-a58e-ec9bd2b43b38).

Suggested wording (the Rust SDK's, from getaxonflow/axonflow-sdk-rust#99): "From platform v11.0.0, on every edition, decide refuses with unsupported_obligation a mandatory obligation the enforcement point cannot discharge, judged against the declared capabilities: an organization's redact override is the shipped case. On Enterprise, in addition, any allow carrying a mandatory obligation outside the declared set becomes a deny."

Correction (2026-09-13): the refusal measured above is the engine's own, not the seam's: composeSet (platform/decision/contract/obligation.go:1148 at 857455033, no build tag, unchanged on main d61b876df) refuses any mandatory obligation the admitted profile cannot discharge (if !in.PEP.Supports(o), :1237) with the bare code unsupported_obligation, which is what decision a74f7483-772c-4187-9165-665aa048f4d7 carried; the validator path (attachValidatorRedactions, cited above) refuses the same way but writes "unsupported_obligation: <detail>". What is Enterprise-only is three handler-level refusals: applyPEPCapabilityRefusal, applyAnchoredCapabilityRefusal and applyMCPRedactionRefusal. So the sentence to carry is "on every edition the engine refuses a caller whose declaration cannot discharge a mandatory obligation", not that the seam or the validator path refuses.