feat: centralize access explanation subject selection

tests/test_access_contracts.py

@@ -32,6 +32,8 @@ from govoplan_core.core.access import (
     AccessDirectory,
     AccessDecisionProvenance,
     AccessExplanationService,
+    AccessExplanationSubjectDecision,
+    AccessExplanationSubjectPolicy,
     AccessGovernanceMaterializer,
     ResourceAccessExplanationProvider,
     AccessSemanticDirectory,
@@ -283,6 +285,22 @@ class _FakeAccessExplanationService:
         return self.provenance
 
 
+class _FakeAccessExplanationSubjectPolicy:
+    def decide_subject_selection(
+        self,
+        session: object,
+        principal: PrincipalRef,
+        *,
+        tenant_id: str,
+    ) -> AccessExplanationSubjectDecision:
+        del session, principal, tenant_id
+        return AccessExplanationSubjectDecision(
+            allow_other_users=True,
+            reason="Administrator diagnostic permitted.",
+            source="test",
+        )
+
+
 class _FakeTenantAccessProvisioner:
     def ensure_default_roles(self, session: object, tenant: object | None = None):
         del session, tenant
@@ -612,6 +630,10 @@ class AccessContractTests(unittest.TestCase):
         self.assertIsInstance(_FakeResourceAccessExplanationProvider(), ResourceAccessExplanationProvider)
         self.assertIsInstance(_FakeFileAccessProvider(), FileAccessProvider)
         self.assertIsInstance(_FakeAccessExplanationService(), AccessExplanationService)
+        self.assertIsInstance(
+            _FakeAccessExplanationSubjectPolicy(),
+            AccessExplanationSubjectPolicy,
+        )
         self.assertIsInstance(_FakeTenantAccessProvisioner(), TenantAccessProvisioner)
         self.assertIsInstance(_FakeAccessAdministration(), AccessAdministration)
         self.assertIsInstance(_FakeAccessGovernanceMaterializer(), AccessGovernanceMaterializer)