Resolves the tenant's effective dual-dimension lifecycle policy from the database (tenant policy → deployment ceiling → DEFAULT template, never deny-all) and re-projects it to Redis via the single existing projector. Returns 200 with the flat dual policy for every existing tenant. A non-existent tenant returns a uniform, oracle-safe 404 that does not confirm existence. Requires the ankasecure-core S2S issuer and the admin.s2s.lifecycle-policy.read scope.