Fix private request-metadata references in search audit tests

[lost-rob0t]

Closes #220.

Fixes the master compile failure caused by two tests referring to the intentionally private request-metadata helper with single-colon external-package syntax.

• changes the two test call sites to star.authorization::request-metadata
• preserves the existing package boundary
• also repairs the adjacent FiveAM assertion in t/addon-system-test.lisp from (is state) to a proper boolean form, allowing the suite to reach the underlying observability lifecycle failure instead of dying in assertion macro expansion
• changes no production/runtime behavior

Five-vote preflight: NARROW / IMPLEMENT / IMPLEMENT / NARROW / NARROW.

Original RED: Smoke jobs 105054404308 and 105054404233 both failed compiling t/authorization-services-final-test.lisp because REQUEST-METADATA is not external.

Reconciled in place on 2026-09-19 with current master@f899612d6e5924ffcc81432d78541b6616311892. Current exact head: 93e0d401be74fdd0ebbb8510e2ba12658f535dee.

At this head the package-qualification compile failure and malformed FiveAM assertion are past; canonical standalone unit tests now reach the pre-existing hosted observability add-on lifecycle failure owned by #224. #224 requires its repository-mandated five-vote/YAGNI gate before production mutation, so this PR must not absorb that fix.

Merge remains authorized only after exact-head CI is fully green and no blocking review exists.

[lost-rob0t]

Exact-head recovery status for 18d503f1963ab220169548449becf5df56c88f2c:

• the intended Fix private request-metadata references in search audit tests #220 RED is fixed: the unit build now gets past the private STAR.AUTHORIZATION:REQUEST-METADATA package error;
• service-backed integration is green;
• schema lock, Operational Salvage, and Container Stack are green;
• Docstring Coverage is red only at generated-doc drift (Fail if generated docs drifted from source), owned by Regenerate stale API docs after observability merge #218 / PR Regenerate stale API docs after observability merge #219;
• the remaining Smoke RED is a distinct current-master regression: OBSERVABILITY-HOSTED-AUTOLOAD-STARTS-NORMAL-ADDON-WHEN-GATE-IS-ON raises ADDON-ERROR: Add-on starintel-observability: load/start failed.

That observability regression is now tracked narrowly as #224. Do not weaken/skip either gate. #221 is otherwise the correct two-reference #220 fix, but exact-head merge remains blocked until #224 and the generated-doc base drift are resolved through their own issue-first gates.

[lost-rob0t]

Exact-head review of 93e0d40: the two request-metadata test call sites now use the intentionally private package symbol via STAR.AUTHORIZATION::REQUEST-METADATA, preserving the production package boundary, and the adjacent FiveAM assertion is repaired from (is state) to an actual boolean predicate. The diff is still only these test repairs; I found no production/runtime mutation. Operational Salvage, schema lock, and Container Stack are green. This slice is technically correct, but merge remains blocked because exact-head Smoke is red on the independently tracked #224 hosted-observability regression and Docstring Coverage is red on the separate #218/#219 generated-doc drift. Do not weaken either gate.