Resolves the one concrete tenant that authorizes a lifecycle operation.
Tenant scope is durable row identity, not a storage prefix. Calls fail closed unless an explicit tenant is supplied or the host has opted into a concrete single-tenant compatibility value.