Validate cadence contract and require functional MFA verification

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ea3-7939-7b63-8125-699f8b50bedd

Makefile

@@ -38,7 +38,7 @@ hooks: ## Configure git to use repo-local hooks (.githooks)
 
 hooks-test: ## Test that the pre-commit hook blocks plaintext secrets
 	@mkdir -p sso-mfa/bootstrap/secrets/_hooktest
-	@echo 'PI_SECRET_KEY=deadbeef' > sso-mfa/bootstrap/secrets/_hooktest/test.env
+	@printf '%s=%s\n' PI_SECRET_KEY deadbeef > sso-mfa/bootstrap/secrets/_hooktest/test.env
 	@git add sso-mfa/bootstrap/secrets/_hooktest/test.env 2>/dev/null || true
 	@if git commit -m "TEST: hook must block this" 2>/dev/null; then \
 	  echo "FAIL: hook did NOT block plaintext commit"; \
@@ -216,6 +216,9 @@ posture-feedback-reference: ## Emit the proposal-only reference report at its fi
 	  --fail-on none \
 	  examples/posture-feedback/expired-e2.yaml
 
+emission-cadence-profile-test: ## Run NetKingdom emission-cadence profile tests
+	python3 -m pytest tools/emission-cadence-profile/tests
+
 security-bootstrap-console-test: ## Run automated tests for bootstrap console UI/sections/runbooks (NET-WP-0018-T07)
 	python3 -m pytest tools/security-bootstrap-console/tests
 
@@ -376,6 +379,7 @@ security-bootstrap-ui: security-bootstrap-metadata-init ## Serve local custody a
         creds-agent-init creds-agent-status creds-emergency-reprint \
         openbao-init-unseal openbao-init-unseal-dry-run \
         iam-profile-conformance-test playbook-contract-test posture-feedback-test \
+        emission-cadence-profile-test \
         posture-feedback-reference security-scenario-compose-lightweight \
         security-bootstrap-console-test security-bootstrap-scripts-syntax \
         security-bootstrap-console security-bootstrap-king-kit \