Verified locally

• pytest -v for policy evaluation and HTTP contract tests
• ruff check src tests function_app.py
• mypy src

The bridge keeps x-kg-caller-id and x-kg-environment conventions, returns x-kg-correlation-id, and uses IBM Cloud IAM bearer auth for upstream forwarding.