feat(orchestration): compose security scenarios

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

examples/security-scenarios/README.md

@@ -0,0 +1,17 @@
+# Security Scenario Examples
+
+`c0-local-identity.yaml` is the first real, locally owned scenario composition.
+It selects the checked-in NetKingdom local-identity declaration, starts from an
+explicit `bare_host_trust` state, and produces a plan for
+`bootstrap_identity_trust`.
+
+The example uses non-production identity values and does not execute anything:
+
+```bash
+python3 tools/security-scenario-composer/security_scenario_composer.py \
+  --scenario examples/security-scenarios/c0-local-identity.yaml \
+  capabilities/playbooks/net-kingdom.local-identity.yaml
+```
+
+A C1/C2 lightweight SSO example belongs here only after the KeyCape/Railiance
+owners publish conformant declarations beside their execution entry points.

examples/security-scenarios/c0-local-identity.yaml

@@ -0,0 +1,15 @@
+id: scenario:c0-local-identity-reference
+authority: netkingdom
+initial_trust:
+  - bare_host_trust
+requires:
+  capabilities:
+    - c0.bootstrap-identity
+providers:
+  c0.bootstrap-identity: net-kingdom.local-identity
+parameter_overrides:
+  net-kingdom.local-identity:
+    local_identity_home: .local/local-identity-reference
+    bootstrap_username: bootstrap-admin
+    bootstrap_fullname: Bootstrap Reference Operator
+    bootstrap_email: bootstrap@example.invalid