Wire the real Cedar engine into the cross-operator-delegation example

[imran-siddique]

What

Make the examples/cross-operator-delegation example enforce scope with the real Cedar engine (ca2a_runtime.cedar.CedarPolicy) instead of the LocalPolicy allow-set it uses today.

Why

The example ships policy.cedar as the intended rule but the demo does not execute the Cedar engine. It enforces with LocalPolicy so the example is guaranteed to run. The example is honest about this, but the flagship cross-operator example should exercise the Cedar path it advertises.

Blocker to resolve first

cedarpy has a version-skewed API: the version resolved in a fresh install exposes is_authorized expecting string requests, while the repo code/tests expect the dict form. Pin cedarpy consistently across pyproject.toml and the test extras so ca2a_runtime.cedar.CedarPolicy and tests/test_cedar.py run against one API.

Steps

• Pin cedarpy to a single known-good version; confirm test_cedar.py passes.
• Switch examples/cross-operator-delegation/demo.py to load policy.cedar via CedarPolicy and enforce scope∩policy through it.
• Keep the LocalPolicy path only if a no-Cedar fallback is wanted; otherwise remove it.
• Re-run the example end to end and keep the honest attestation labeling unchanged.

Follow-up to #43 / PR #44.