feat(multi-tenant-saas): model a real HR SaaS with EU vs US tenants

[imran-siddique]

What

Replaces the acme-corp/globex-financial placeholders with PeopleGraph, a fictional HR/people-analytics SaaS whose two tenants differ by genuine data processing agreement terms, not just an enforcement flag. Second of three per-example realism PRs (financial-services is #53; healthcare to follow).

Why

The old example used the two most generic placeholder company names in existence, three generic tools, and tenants that differed only by workflow gating. It read as a toy.

Changes

• Two believable tenants on one catalog:
  • metzler-eu (EU employer, enforcing): GDPR guardrails enforced — declared legal basis (Art. 6), EEA data residency (Art. 44–45), no special-category processing (Art. 9).
  • summit-us (US employer, advisory): permissive baseline; special-category access flagged for review but not blocked.
• Same four calls, different outcomes. Headcount and employee lookup allow on both; the EU tenant blocks the cross-region export (us-east-1) and the special-category lookup, while the US tenant allows the export and only logs the special-category flag.
• Realistic domain data. New people_directory.py holds employee fixtures + tool logic; the mock server serves from it. Responses are free of PII patterns that would trip the runtime's response scanner.
• Tests + CI + smoke. New tests/test_people_directory.py and a CI job; the smoke matrix updated for the new tenant names.
• Regenerated one signed TRACE record per tenant from real runs.

Verification

• python -m unittest discover -s tests -v → 5 pass
• Both tenants run end-to-end; cmcp verify passes schema, signature and audit chain on each record (hardware attestation fails in software-only dev mode, as expected)
• EU record: 4 calls, 2 allowed, 2 denied (enforce); US record: 4 calls, 3 allowed, 1 advisory match (advisory)
• Both agents exit 0, so the smoke jobs stay green
• Catalog definition_hash values recomputed and self-checked

🤖 Generated with Claude Code