chore(stack): sync admin tenant isolation into deletion ledger

[seonghobae]

Purpose

Synchronize exact parent head 3ba53ac843685e483fdd3f8f060ba61825b9a798 into stack/durable-deletion-receipt-ledger-v1 without changing the bounded ledger slice. The parent adds a test-first fail-closed fix so null or blank lifecycle-event tenant queries cannot infer buyer-demo.

Merge contract

• Head: stack/admin-endpoint-auth-v1 at 3ba53ac843685e483fdd3f8f060ba61825b9a798
• Base: stack/durable-deletion-receipt-ledger-v1 at 8448fdd98d4a6c58f4e5407fcfcce903785abaa8
• This is stack synchronization only, not integration into protected main.
• Merge only after exact-head checks and review are complete; then revalidate PR feat(lifecycle): add immutable artifact-deletion receipt foundation #280's new exact head.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 00d6c83c-3a65-4d0b-a846-6697993d31b6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Closing as superseded. The stack-sync intent was applied directly to stack/durable-deletion-receipt-ledger-v1 in test-first order: RED 1f4abb80fa18fe00f336dc0d7c656f90d5901ec7 adds the null/blank lifecycle-tenant isolation regression, and GREEN 2c15cfbf85de33aa7ed72cdeb2dc9f8c8fd77943 makes the scoped lifecycle query fail closed while preserving explicit legacy behavior. This PR is now stale and unmergeable against the advanced ledger branch; merging it would add no valid code change and would obscure exact-head evidence. PR #280 must be re-reviewed and revalidated at its new exact head.

[seonghobae]

Closing as superseded, without merge. This temporary sync PR was created before the immutable base branches gained the all-PR exact-head CI contract. PR #280 now targets the live stack/admin-endpoint-auth-v1 base directly, and its synthetic-merge job validates the moving parent together with the ledger slice. #281 contains no independent product change, is behind both current stack heads, and would add a redundant merge commit rather than preserve the bounded stack. Parent changes remain represented by #268; ledger changes remain represented by #280.

[seonghobae]

Superseded by clean v2 ancestry. The valid tenant lifecycle-event isolation from exact head 3ba53ac843685e483fdd3f8f060ba61825b9a798 is now the immutable parent snapshot for #282, whose RED/GREEN receipt commits are direct descendants (2 commits / 11 files / 0 behind). #283 is the one-commit worker descendant of that exact foundation. Closing this reverse stack-sync PR unmerged avoids a merge commit that would invalidate base-sensitive evidence. No check, review, approval, or main integration is inferred.