test(tenancy): prove boundary and snapshot read isolation (#157)

[smiggleworth]

Summary

• Add a two-tenant broker matrix for current boundary and program-scope snapshot reads over HTTP and MCP in standalone and split API/worker hosts. One owner belongs to both tenants; a distinct verified and invited reviewer approves each tenant's first boundary through HTTP; an unrelated authenticated user has no tenant access.
• Read Program boundary lists, approved version lists, decision lists, effective versions, boundary and decision details, impact previews, snapshot lists/details, verification, and manifest regeneration. Assert tenant, Program, boundary, snapshot, and manifest IDs plus digest shape on returned data.
• Walk paged boundary, decision, and snapshot lists to their terminal cursors. Require an A-issued cursor to be rejected in B with HTTP 400 and MCP Validation. Prove foreign IDs under B and outsider requests return NotFound over both transports for all twelve read families.

Contributes EN-01 read-isolation evidence to #157. Keep #157 open for actor lifecycle proof, other tenant-owned read surfaces, and future count/search routes. This test seeds one approved version per tenant; it does not prove multi-version pagination or nonempty nested impact contribution records. Personal review and approval use HTTP only.

Based on merged #375 (c5d5249331f4c4e400831d8509188dbbab6159db); current head 2bf29354cb9e417fd2595f43cba6f1c5640746c0. The reviewer-invitation fixture waits for the projected delivered outcome before acceptance.

Validation

• Release build with AOT analyzer — 0 warnings/errors.
• Scoped format check — dotnet format --verify-no-changes for the changed test.
• Focused broker — ./scripts/check-backend.sh focused 'FullyQualifiedName~BoundarySnapshotReadLeakMatrixE2ETests.ShouldScopeBoundaryAndSnapshotReadsGivenTwoTenants' passed 2/2 after the strict-cursor edit (standalone and split hosts).
• Exact-head CI — run 35921440066 passed Validate, dependency review, and native AMD64/ARM64 checks on 2bf29354cb9e417fd2595f43cba6f1c5640746c0.

Contracts and operations

• Authentication and authorization — tenant member, member of both tenants, and unrelated authenticated user are exercised on current read routes.
• API, persistence, and wire compatibility — test-only change; existing HTTP and MCP contracts are exercised without runtime changes.
• Deployment and rollback — no runtime change; revert the test commit to roll back this proof.