#1036 A deactivated tenant is not blocked anywhere: no code reads tenant_client_keys.status

EARS SPEC (draft): - While a tenant's tenant_client_keys.status is 'deactivated', the Highway API shall refuse that tenant's requests (JWT and API key) with 403 TENANT_DEACTIVATED. - While a tenant is deactivated, workflow submission (API, schedules, durable_cron, tools.workflow.spawn) shall refuse new runs for it. - The behaviour for in-flight runs and sleeping schedules of a deactivated tenant shall be decided and specified (cancel, pause, or let finish). FOUND DURING #908 (verified by submodule-aware grep 2026-10-20): the only readers of tenant_client_keys.status are enterprise/security/platform_tenants.py get_tenant/list (display) and the lifecycle API pre-checks. api/middleware (rbac_permissions, rbac_token), auth_wrapper, rbac_manager.get_client_key, workflow_submission_service and the engine scheduler do not read status/deactivated_at/suspended_at. After #908 a deactivate run sets status='deactivated' but the tenant keeps full access. The deactivate endpoint docstring claimed 'Cannot authenticate or run workflows'; #908 removed that claim.