test: clarify state-driven authorization behavior

[rlippmann]

Summary

Make the execution-authorization FastAPI example's proof shape more explicit and clean up PR-template lint handling.

Changes in this PR:

• Add a compact matrix test for /compiler/expenses
• Reuse the same approved-model stub and same base expense payload across multiple authoritative-state variants
• Demonstrate that only authoritative Context Compiler state changes the outcome:
  • absent state -> denied
  • use expense_approval -> executed
  • contradictory update -> clarify
• Reuse a shared request payload in the live-model test for a cleaner comparison
• Add a README table showing "same request, different state, different outcome"
• Move the PR-template MD041 exception into markdownlint configuration
• Remove the visible inline markdownlint suppression from the PR template

Why

The execution-authorization example already enforced authorization from Context Compiler state.

However, the proof was distributed across multiple tests and scenarios. This made it easier to interpret the behavior as endpoint-specific logic or a framework permission check.

This PR makes the state-driven nature of the authorization decision more explicit by showing the same request producing different outcomes solely because authoritative Context Compiler state differs.

Additionally, the PR template cleanup removes a visible markdownlint suppression comment while preserving lint coverage.

Example metadata

• Enforcement point: Execution authorization
• Domain: Expense approval
• Technology/runtime: FastAPI
• Example type: Runtime-boundary comparison
• Does this use directive drafter? should normally be no: No
• Does this derive state from model output? must be no for primary examples: No

Checklist

• One primary enforcement point
• Explicit authoritative state
• No model-derived state mutation
• Observable runtime behavior change
• Framework is secondary to the enforcement point
• Docs updated
• Tests updated

Validation

./scripts/validate_python.sh