build: add guarded Kubernetes plane executor

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02878-7c21-7692-bcd6-ce2838c4b448

bundles/whitehat-foundational-plane.yaml

@@ -0,0 +1,61 @@
+schema_version: ops-mason.kubernetes-plane/v1
+id: whitehat-foundational-plane
+plan: ../plans/whitehat-foundational-plane.md
+expected_context: default
+expected_namespace: whitehat
+source_repo: whitehat-security
+source_revision: 4882c2d47a826a305d5c4e05aa7fcc1252c3887e
+implementation_revision: 95129d7a35c8999be359b163b554853c9c6afa3a
+evidence_path: ../docs/evidence/whitehat-foundational-plane.json
+forbidden_kinds:
+  - Pod
+  - Secret
+manifests:
+  - path: ../manifests/whitehat-plane/namespace.yaml
+    source_path: plane/namespace.yaml
+    sha256: a0919aa0c3d5f92844eeea3834fc684bc6ad112a3c4419be7f759f6b31c1d7a8
+  - path: ../manifests/whitehat-plane/network-policy.yaml
+    source_path: plane/network-policy.yaml
+    sha256: 05097e33221f93f4d82da7c4d5bb688c5ec5807dc15ab4378263cddad6031610
+  - path: ../manifests/whitehat-plane/service-account.yaml
+    source_path: plane/service-account.yaml
+    sha256: 42cb5276ea2f0a555ea835fed5c14397fe76fbfa18b1acec1f3168bb1db54a5d
+allowed_objects:
+  - api_version: v1
+    kind: Namespace
+    resource: namespaces
+    name: whitehat
+  - api_version: networking.k8s.io/v1
+    kind: NetworkPolicy
+    resource: networkpolicies.networking.k8s.io
+    namespace: whitehat
+    name: default-deny
+  - api_version: networking.k8s.io/v1
+    kind: NetworkPolicy
+    resource: networkpolicies.networking.k8s.io
+    namespace: whitehat
+    name: allow-audit-core-e2
+  - api_version: v1
+    kind: ServiceAccount
+    resource: serviceaccounts
+    namespace: whitehat
+    name: whitehat-runner
+dependencies:
+  - resource: services
+    namespace: audit-core
+    name: audit-core
+    assertions:
+      - path: /spec/ports/0/port
+        equals: 8080
+  - resource: networkpolicies.networking.k8s.io
+    namespace: audit-core
+    name: audit-core-whitehat-ingress
+    assertions:
+      - path: /spec/ingress/0/ports/0/port
+        equals: 8080
+      - path: /spec/ingress/0/from/0/namespaceSelector/matchLabels/kubernetes.io~1metadata.name
+        equals: whitehat
+      - path: /spec/ingress/0/from/0/podSelector/matchLabels/whitehat.security~1plane
+        equals: "true"
+      - path: /spec/ingress/0/from/0/podSelector/matchLabels/whitehat.security~1target
+        equals: audit-core