Returns the tenant's cryptographic-posture summary — the four scalar CAPA-pillar aggregates
(agility, modernization, governance, conformance), evaluated strictly within the tenant
boundary. Scalars and states only: no tenant identifier, key identifier, or policy field value.

Conformance enforces SIX simple-algorithm criteria — explicitAlgorithms, allowedCategories,
allowedLevels, allowedOperations, mandatoryStandards, minSecurityLevel — and applies FIVE of
them to composite algorithms (the per-entry allowedCategories check is not applied to
composites). SIX policy fields are not yet enforced: allowedFamilies, requireComposite,
allowedCompositeModes, allowedKdfs, customRules, regulatoryFramework. The conformance
evaluation is therefore deliberately partial.

Authorization:
• Tenant admins: view own tenant's posture only
• Platform admins: view any tenant's posture

Path Parameter Validation:
The tenantId in the URL must match the JWT tenantId claim
(unless authenticated as platform admin with PLATFORM.ROOT scope).