Add RBAC ABAC freshness gates

[Errordog2]

Summary

• add ABAC attribute provenance and freshness gates for authoritative source, trust tier, owner, max age, token-derived status, and server-side rehydration
• add PDP/PIP failure-mode checks for fail-closed sensitive actions, bounded last-known-good caches, cache invalidation, and attribute conflict precedence
• extend the output format with attribute evidence, PDP/PIP resilience, policy version, attribute age/source, and decision auditability fields

Addresses #2550.

Validation

• git diff --check
• Markdown fence balance check
• targeted marker check for RBAC-ATTR gates, PDP/PIP failure modes, attribute evidence matrix, decision auditability, and v1.0.1