Add Tenuo authorization contrib module

[aimable100]

Summary

Adds temporalio.contrib.tenuo, a SimplePlugin that wires Tenuo warrant-based authorization into Temporal workflows. Agents (workflows) carry signed warrants specifying which tools (activities) they can call and with what argument constraints. Sub-agents (child workflows) receive attenuated warrants — capabilities can only shrink, never expand.

• TenuoPlugin — registers client interceptor (warrant header injection), worker interceptors (PoP signing + authorization verification), and sandbox passthrough for the tenuo native extension.
• Thin adapter — only 3 symbols exported from the contrib module (TenuoPlugin, TENUO_PLUGIN_NAME, ensure_tenuo_workflow_runner). All other types are imported from tenuo.temporal, matching the pattern established by openai_agents and other contrib modules.
• No private imports — all tenuo.temporal internals used by the plugin are exposed through public lazy-loaded names.

Files

File	Lines	Purpose
temporalio/contrib/tenuo/__init__.py	27	Public API (3 exports)
temporalio/contrib/tenuo/_plugin.py	180	TenuoPlugin SimplePlugin subclass
temporalio/contrib/tenuo/README.md	371	Documentation with multi-agent delegation example
tests/contrib/tenuo/test_tenuo.py	464	Unit tests + live integration tests
tests/contrib/tenuo/test_tenuo_replay.py	243	Record-and-replay determinism tests
pyproject.toml	+2	tenuo optional dependency

Replay safety

Replay determinism is verified at two levels:

1. Static analysis — source inspection confirms workflow.now() (not time.time()), no datetime.now(), no os.urandom/random/uuid4, no time.sleep, no threading.Thread.
2. Live record-and-replay — workflows execute against a local Temporal server, history is captured via fetch_history(), and a fresh TenuoPlugin instance replays via Replayer. Tests cover single-tool and multi-tool (sequential PoP ordering) scenarios.

Integration tests

• test_authorized_activity_succeeds — full warrant → PoP → authorization flow
• test_start_workflow_authorized — start_workflow_authorized returns a handle
• test_unauthorized_activity_is_non_retryable — unauthorized tool call produces WorkflowFailureError with ApplicationError(non_retryable=True)
• test_duplicate_registration_raises — same plugin instance on two workers raises RuntimeError

Test plan

• pytest tests/contrib/tenuo/test_tenuo.py -v — unit + integration tests pass
• pytest tests/contrib/tenuo/test_tenuo_replay.py -v — replay determinism tests pass
• ruff check temporalio/contrib/tenuo/ tests/contrib/tenuo/ — no lint errors