Test: Verify Cortex authz capabilities end-to-end (at least OPA)

Summary

Verify the authorization (authz) capabilities of the CPEX integration in Cortex end-to-end, covering at least OPA (Open Policy Agent).

CPEX = the ContextForge plugin framework (contextforge-org/contextforge-plugins-framework), integrated into Cortex via the CPEX plugin (rossoctl/cortex#493). This issue validates that authz enforcement through CPEX-hosted policies (OPA first) works as intended.

Scope

• Validate CPEX authz enforcement end-to-end, with OPA as the first covered engine.
• Exercise allow/deny policy decisions through the pipeline.
• Ideally verify across the supported proxy modes (Go proxy / Envoy / Praxies) once the shim rearchitecture lands.

Docs to revisit / consolidate

The hook-system + CPEX-integration design proposal — docs/proposals/authbridge-hooks.md (still marked Status: Draft, ~1460 lines) — was added by the same CPEX PR (#493) that also merged the living reference docs. Now that it's implemented, revisit whether the proposal can be removed (or archived as "accepted/implemented") in favor of the living docs, to avoid drift:

• authbridge/docs/cpex-plugin.md — CPEX plugin reference (added in #493)
• authbridge/docs/framework-architecture.md — hook / pipeline architecture
• authbridge/docs/plugin-reference.md — per-plugin config, session events, action vocabulary
• authbridge/authlib/plugins/cpex/README.md + authbridge/demos/hr-cpex/ demo

Proposal sections that appear to map onto living docs (candidates for deletion vs. archival):

• §3–5 Hook catalog / payloads / dispatch semantics → framework-architecture.md
• §6 Configuration, §7 Integration architecture (incl. §7.5 CPEX-vs-AuthBridge split) → cpex-plugin.md + plugin-reference.md
• §8 Built-in plugin migration, §10 Security invariants → plugin-reference.md / per-plugin docs

Decision to make: delete the proposal, or keep it as a historical record — at minimum flip its stale Status: Draft if it's retained.

Related

• Part of epic: Cortex Phase 1 (rossoctl/rossoctl#2244)
• CPEX plugin PR (added the proposal + living docs): rossoctl/cortex#493