Installs the single-write guard over request.user and request.tenant.

Called once per request by the kernel's request-context factory — the one funnel every request passes through whatever produced its IRequest — and by @setu-ts/testing's createTestContext, so the test double honours the same contract the kernel enforces.

A value already present on the request (a test context seeded with a principal) is migrated into the backing slot and counts as the first write, so a seeded request refuses a further implicit assignment exactly as an authenticated one does. Calling this twice on the same request is a no-op: the second call sees the accessors already installed and leaves the written-flags alone.