`npm run gen:behaviour-spec`'s drift check (part of `npm run ci`) caught two things: RB-07 had already left this generated doc stale (three of its new AuthzAuditTests cases were never picked up), and RB-08/RB-09 added more test names since. Regenerated so the doc matches the suite it claims to mirror. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>