chore(security): run a security analysis pass

[araujof]

Description

The engine decides who may call which tool, what data comes back, and where it may go next, so a bypass is an authorization failure rather than a bug. There has been no dedicated security review.

Run /code-review and the compound-engineering ce-code-review over the workspace and triage what comes back. Prior fixes show the shape of what to look for: an integer cast that wrapped delegation.depth and turned a depth rule into a bypass, a dropped orchestrator outcome that became Aborted when it was really a Deny, an empty issuer algorithm list read as "any algorithm acceptable", and a missing nbf check on inbound JWTs.

Priority surfaces:

• crates/ppe-apl-core/src/parser.rs and evaluator.rs, which take operator policy text.
• builtins/plugins/identity-jwt, token validation and header resolution.
• builtins/plugins/delegator-oauth, RFC 8693 exchange and token scoping.
• crates/ppe-core/src/executor.rs and engine.rs, the fail-open paths where a configured Fail could become an Ignore.
• The PDP resolvers in builtins/pdps/, where an error is converted to a decision.

Every finding gets a regression test. Fail-closed behavior is the property under test, so a test that only asserts the happy path does not close a finding.

Acceptance criteria

• Both reviews are run and their findings triaged into fix, accept with reason, or reject as false positive.
• Every accepted finding has a fix and a test that fails without it.
• Any fail-open path found is either closed or documented as a deliberate choice with the operator-visible consequence stated.
• make audit (cargo-deny) is green.
• Findings and dispositions are written up in docs/.