feat(posture): add deterministic feedback proposals

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

Makefile

@@ -199,6 +199,16 @@ security-scenario-compose-c0: ## Compose the plan-only C0 local-identity referen
 	  --scenario examples/security-scenarios/c0-local-identity.yaml \
 	  capabilities/playbooks/net-kingdom.local-identity.yaml
 
+posture-feedback-test: ## Run deterministic posture-feedback tests
+	python3 -m pytest tools/posture-feedback/tests tools/tenancy-posture/test_validate.py
+
+posture-feedback-reference: ## Emit the proposal-only reference report at its fixed example time
+	python3 tools/posture-feedback/posture_feedback.py \
+	  --as-of 2026-08-23T12:00:00Z \
+	  --horizon-days 14 \
+	  --fail-on none \
+	  examples/posture-feedback/expired-e2.yaml
+
 security-bootstrap-console-test: ## Run automated tests for bootstrap console UI/sections/runbooks (NET-WP-0018-T07)
 	python3 -m pytest tools/security-bootstrap-console/tests
 
@@ -358,7 +368,8 @@ security-bootstrap-ui: security-bootstrap-metadata-init ## Serve local custody a
         creds-status creds-rotate \
         creds-agent-init creds-agent-status creds-emergency-reprint \
         openbao-init-unseal openbao-init-unseal-dry-run \
-        iam-profile-conformance-test playbook-contract-test \
+        iam-profile-conformance-test playbook-contract-test posture-feedback-test \
+        posture-feedback-reference \
         security-bootstrap-console-test security-bootstrap-scripts-syntax \
         security-bootstrap-console security-bootstrap-king-kit \
         security-bootstrap-validate-kit security-bootstrap-validate-t02 \