[tenant-core] Preserve authorization outcomes when policy trace sinks fail

[kang-heewon]

Priority: P1

Problem

Tenant isolation allows and denies await trace and audit sinks before returning or throwing the policy decision. An observability failure can block allowed work or replace the intended denial Problem.

Evidence

packages/tenant-core/src/libs/TenantIsolationEnforcer.ts:345-437 awaits recordPolicyDecisionTrace and auditSink.recordTenantIsolation on both allow and deny paths.

Desired outcome

Observability delivery does not alter the authorization outcome unless an explicit fail-closed policy is selected.

Implementation path

1. Define best-effort default behavior with telemetry/diagnostic evidence.
2. Preserve an explicit optional fail-closed mode if needed.
3. Ensure deny always throws its original Tenant Problem.
4. Test rejected trace and audit sinks on allow, deny, and query paths.

Acceptance criteria

• Allowed decisions remain allowed when default sinks fail.
• Denials retain their original Problem identity.
• Sink failure is observable without sensitive leakage.

Validation

pnpm --filter @croco/tenant-core test

Scope boundaries

Does not change tenant matching or authorization rules.