Add versioned ephemeral custody lifecycle

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

docs/custody-projection-contract.example.json

@@ -0,0 +1,59 @@
+{
+  "interface": "railiance.custody-projection-contract",
+  "version": 1,
+  "workplan_id": "RAILIANCE-WP-0025",
+  "engagement_id": "REPLACE-WITH-NEW-TERMINAL-UNIQUE-ID",
+  "status": "replace-with-explicit-approval",
+  "engagement_contract_sha256": "replace-with-64-lowercase-hex",
+  "target": {
+    "id": "replace-with-target-id",
+    "namespace": "replace-with-target-namespace",
+    "deployment": "replace-with-target-deployment",
+    "container": "replace-with-target-container",
+    "sender_external_secret": "replace-with-sender-external-secret",
+    "revision": "replace-with-full-40-character-git-revision",
+    "image_digest": "sha256:replace-with-64-lowercase-hex",
+    "contract_sha256": "replace-with-64-lowercase-hex"
+  },
+  "runner": {
+    "namespace": "whitehat",
+    "service_account": "whitehat-runner",
+    "secret_name": "replace-with-exact-mounted-secret-name",
+    "mount_root": "/var/run/secrets/whitehat",
+    "manifest_sha256": "replace-with-64-lowercase-hex"
+  },
+  "window": {
+    "starts_at": "replace-with-RFC3339-start",
+    "projection_cutoff": "replace-with-RFC3339-projection-cutoff",
+    "expires_at": "replace-with-RFC3339-expiry-at-most-900-seconds-after-start"
+  },
+  "authority": {
+    "remote": "railiance01",
+    "registry_path": "replace-with-exact-platform-registry-path",
+    "registry_field": "senders.json",
+    "kv_mount": "platform",
+    "kv_prefix": "engagements/REPLACE-WITH-NEW-TERMINAL-UNIQUE-ID/replace-with-target-id",
+    "eso_service_account": "external-secrets",
+    "eso_namespace": "external-secrets"
+  },
+  "identities": [
+    {
+      "handle": "token-a",
+      "role": "attacker",
+      "sender_name": "replace-with-new-attacker-sender",
+      "tenant": "replace-with-new-attacker-fixture-tenant",
+      "mount_path": "/var/run/secrets/whitehat/token-a",
+      "may_read": true,
+      "may_write": true
+    },
+    {
+      "handle": "token-b",
+      "role": "owner",
+      "sender_name": "replace-with-new-owner-sender",
+      "tenant": "replace-with-new-owner-fixture-tenant",
+      "mount_path": "/var/run/secrets/whitehat/token-b",
+      "may_read": true,
+      "may_write": true
+    }
+  ]
+}