build: add guarded Kubernetes plane executor

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02878-7c21-7692-bcd6-ce2838c4b448

manifests/whitehat-plane/README.md

@@ -0,0 +1,31 @@
+# Whitehat foundational plane source pins
+
+These three YAML files are byte-for-byte pins of the selected
+`whitehat-security` contract files at coordination revision
+`4882c2d47a826a305d5c4e05aa7fcc1252c3887e`; the implementation revision is
+`95129d7a35c8999be359b163b554853c9c6afa3a`.
+
+The preserved `CONTRACT ONLY` header means the source repository does not own
+or perform the apply. In this repository, only the guarded bundle executor may
+apply them, after validating `bundles/whitehat-foundational-plane.yaml` and the
+approved construction plan. Do not invoke `kubectl apply` directly on this
+directory.
+
+Pinned SHA-256 digests:
+
+- `namespace.yaml`: `a0919aa0c3d5f92844eeea3834fc684bc6ad112a3c4419be7f759f6b31c1d7a8`
+- `network-policy.yaml`: `05097e33221f93f4d82da7c4d5bb688c5ec5807dc15ab4378263cddad6031610`
+- `service-account.yaml`: `42cb5276ea2f0a555ea835fed5c14397fe76fbfa18b1acec1f3168bb1db54a5d`
+
+Excluded unconditionally: runner Pod, Secret, credential, projected identity,
+engagement lease, and traffic.
+
+Rollback is generated by:
+
+```bash
+ops-mason plane rollback-plan \
+  --bundle bundles/whitehat-foundational-plane.yaml
+```
+
+It never executes deletion. Namespace deletion remains conditional on a fresh
+inventory proving that no later or unrelated object entered the namespace.

manifests/whitehat-plane/namespace.yaml

@@ -0,0 +1,9 @@
+# CONTRACT ONLY. Do not apply from this repository.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: whitehat
+  labels:
+    app.kubernetes.io/name: whitehat-security
+    whitehat.security/plane: "true"
+    pod-security.kubernetes.io/enforce: restricted

manifests/whitehat-plane/network-policy.yaml

@@ -0,0 +1,40 @@
+# CONTRACT ONLY. Do not apply from this repository.
+# Default deny in namespace whitehat; live E2 adds a named egress rule per
+# registered target. This example names audit-core only as the currently
+# applicable live E2 target.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: whitehat
+spec:
+  podSelector: {}
+  policyTypes: ["Ingress", "Egress"]
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-audit-core-e2
+  namespace: whitehat
+spec:
+  podSelector:
+    matchLabels:
+      whitehat.security/target: audit-core
+  policyTypes: ["Egress"]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: audit-core
+      ports:
+        - protocol: TCP
+          port: 8080
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53

manifests/whitehat-plane/service-account.yaml

@@ -0,0 +1,9 @@
+# CONTRACT ONLY. Do not apply from this repository.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: whitehat-runner
+  namespace: whitehat
+  labels:
+    app.kubernetes.io/name: whitehat-security
+automountServiceAccountToken: false