Implement KG-WP-0002 posture pilot scaffold

src/kings_guard/fixtures/qonto_assistant_pilot.json

@@ -0,0 +1,58 @@
+{
+  "normalized_genome": {
+    "genome_id": "kg:genome:qonto-assistant",
+    "version": "0.1.0",
+    "subject_id": "qonto-assistant",
+    "tenant_id": "binky",
+    "intended_purpose": "Hold the company Qonto credential behind a governed read-only finance surface for authorized operators and agent harnesses.",
+    "permitted_capabilities": [
+      "finance.qonto.read"
+    ],
+    "permitted_protocols": [
+      "rest",
+      "mcp"
+    ],
+    "permitted_egress": [
+      "openbao",
+      "qonto-thirdparty-api"
+    ],
+    "data_classifications": [
+      "tenant-confidential",
+      "financial"
+    ],
+    "tolerances": [
+      {
+        "tolerance_id": "self-asserted-actor-claims",
+        "match_field": "identity_binding",
+        "match_value": "self_asserted",
+        "description": "Actor identity is still self-asserted until key-cape integration lands.",
+        "effect": "monitor"
+      }
+    ]
+  },
+  "qonto_audit_event": {
+    "request_id": "req-qonto-deny-credential-exfil",
+    "timestamp": "2026-07-23T09:10:00Z",
+    "actor": "agt-laptop-risky",
+    "tenant_id": "binky",
+    "capability": "org_summary",
+    "protocol": "mcp",
+    "decision": "deny",
+    "deny_reason": "credential_exfil",
+    "policy_version": 1,
+    "latency_ms": 12,
+    "qonto_http_status": null,
+    "result_count": null
+  },
+  "normalization_hints": {
+    "subject_id": "qonto-assistant",
+    "capability_scope": "finance.qonto.read",
+    "identity_binding": "self_asserted",
+    "egress_destination": "qonto-thirdparty-api"
+  },
+  "source_notes": [
+    "Derived from qonto-assistant/specs/security-genome.yaml",
+    "Derived from qonto-assistant/src/qonto_assistant/contracts.py#AuditEvent",
+    "Pilot chooses qonto-assistant because it already ships an audit stream, a genome record, and a fast local loop."
+  ]
+}