fix: log InvalidTag on capability-flag decrypt (D5)

narrow list_keys _can_authorize's bare except: (KeyError, TypeError,
ValueError) degrade to '?' silently (benign/malformed/foreign-shape flag),
but a cryptography InvalidTag now logs WARNING first. a GCM auth-tag failure
on an authz flag is either a foreign key this host can't decrypt or a tampered
authz record, and this layer can't distinguish them - the security signal must
stay observable rather than render identically to a routine '?'.

logs the friendly name (fallback: fingerprint) only - no blob, DEK, or
exception repr. a swallow that recovers must log (settled rule).

Signed-off-by: disqualifier <dev@disqualifier.me>

src/envelope_authorizer/commands/list_keys.py

@@ -5,16 +5,31 @@ CAN_AUTHORIZE (`?` if unreadable here). prints only fingerprint/metadata - never
 the wrapped key or DEK.
 """
 
+import logging
 from datetime import datetime, timezone
 
+from cryptography.exceptions import InvalidTag
+
 from . import boot_local, doc_meta, read_flag
 
+log = logging.getLogger(__name__)
+
 
 def _can_authorize(crypto, doc) -> str:
-    """decrypted authority of a doc as Yes/No, or `?` if unreadable here"""
+    """decrypted authority of a doc as Yes/No, or `?` if unreadable here
+
+    a malformed/foreign flag degrades to `?` for display continuity. a GCM auth-tag
+    failure is logged first (WARNING): it is either a foreign key this host can't
+    decrypt or a tampered authz record, and this layer can't tell them apart, so the
+    security signal must stay visible rather than render identically to a `?`.
+    """
     try:
         return "Yes" if read_flag(crypto, doc["meta"]["authorizer"]) else "No"
-    except Exception:
+    except (KeyError, TypeError, ValueError):
+        return "?"
+    except InvalidTag:
+        friendly = doc_meta(doc).get("friendly", doc.get("_id", "?"))
+        log.warning("auth-tag verification failed for flag %s - foreign key or tampered record", friendly)
         return "?"