build: provision and verify Whitehat foundational plane

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02878-7c21-7692-bcd6-ce2838c4b448

src/ops_mason/kubernetes_plane.py

@@ -555,7 +555,10 @@ def apply(
     _check_inputs_clean(bundle, runner)
     before = preflight(bundle, runner)
 
+    server_validated = list(before["server_validated_manifests"])
+    persisted: list[str] = []
     for manifest in bundle.manifests:
+        relative_path = str(manifest.path.relative_to(bundle.repo_root))
         docs = list(yaml.safe_load_all(manifest.path.read_text()))
         namespaced = any(doc.get("metadata", {}).get("namespace") for doc in docs)
         if namespaced:
@@ -571,6 +574,7 @@ def apply(
                     str(manifest.path),
                 ],
             )
+            server_validated.append(relative_path)
         _run(
             runner,
             [
@@ -582,6 +586,7 @@ def apply(
                 str(manifest.path),
             ],
         )
+        persisted.append(relative_path)
 
     verified = verify(bundle, runner)
     evidence = {
@@ -597,6 +602,11 @@ def apply(
             "revision": bundle.source_revision,
             "implementation_revision": bundle.implementation_revision,
         },
+        "apply": {
+            "field_manager": "ops-mason",
+            "server_validated_manifests": server_validated,
+            "persisted_manifests": persisted,
+        },
         "preflight": before,
         "verification": verified,
         "rollback": rollback_plan(bundle),