test(tenancy): prove Program and service read isolation (#157)

[smiggleworth]

Summary

• Add a two-tenant real-broker matrix for Program current list, revision history, setup-work, exact current and revision reads, plus ClientService tenant and Program lists, revision history, and exact current and revision reads.
• Exercise HTTP and MCP in standalone and split API/worker hosts. Seed two distinct Programs and services per tenant, revise one of each, follow list cursors to their terminal page, and assert tenant/parent IDs, seeded names and purpose, revisions, and setup-work boundary IDs.
• Require tenant A cursors to be rejected in tenant B with HTTP 400 and MCP Validation for all six paged families. Assert foreign Program/service IDs under a valid B tenant and outsider requests return NotFound over both transports. The exact service route has no program_id input; positive reads verify its returned Program association.

Contributes EN-01 backend read-isolation evidence to #157. Keep #157 open for actor lifecycle proof, other tenant-owned surfaces, and future count/search routes; these Program and service routes do not expose counts. Detailed scope and limits are in docs/architecture/program-service-read-leak-evidence.md.

Based on merged #373 (fd6237b508f78e9028dc3561d576b33acc142998); current head 41e8e257e0d3a1dd4786c2b03105a67c8ae36751.

Validation

• Release/AOT analyzer build — zero warnings/errors after rebase.
• Scoped format and git diff --check — passed.
• Focused broker — ./scripts/check-backend.sh focused 'FullyQualifiedName~ProgramReadLeakMatrixE2ETests.ShouldScopeProgramAndServicePagesGivenTwoTenants' passed 2/2 after rebase.
• Exact-head CI — run 35924630083 passed Validate (including the full real-broker suite), dependency review, and native AMD64/ARM64 at 41e8e257e0d3a1dd4786c2b03105a67c8ae36751.

Contracts and operations

• Authentication and authorization — two populated tenants, one member of both, and an unrelated authenticated user are exercised on both transports and host modes.
• API, persistence, scheduling, and wire compatibility — test and evidence documentation only; existing routes and MCP tools are exercised without runtime changes.
• Deployment and rollback — no runtime or configuration change; revert this test commit to remove the proof.

[smiggleworth]

Current-head CI run 35917447426 completed with 61/62 broker tests passing. The failure was in the existing split-host self-service test: the administrator team was readable while the separate tenant projection still reported provisioning. PR #375 adds a bounded poll for the tenant to become active; its focused broker case passed locally. I will rebase this PR after #375 merges and require a new exact-head CI run before merge.