[Epic] Implement identity, policy, isolation, and audit #4

Outcome

Every accepted or rejected action has authenticated identity, scoped authorization, workspace isolation, and a tamper-evident audit record.

Scope

• Implement OIDC, hierarchical authorization, policy decisions, API enforcement, provider credential brokering, isolation, and audit integrity.

Acceptance criteria

• Every public action has allow and deny tests.
• Cross-workspace and privilege-escalation probes fail.
• Credentials and tokens are absent from state and telemetry.

Test and evidence

• Security conformance matrix and audit-integrity verification are linked.

Dependencies

• None.

References

• Security model
• Architecture overview
• OAuth 2.0 Security Best Current Practice (RFC 9700)