Implement SECRETS-WP-0008 unblocked layer-model obligations

Load pep-stance.yaml as the live unreachable-engine gate and record named
stance fields on privileged evidence. Classify evidence, queue load-bearing
records in a local outbox, and add heartbeat/drain commands that never sit
on a mutation path. Publish proposed SSH-CA and secret-use evidence
contracts without adding an OpenBao SSH-CA write.

T02 (access-engine decision records) and T06 (no standing credential) stay
wait on external endpoints.

Assistant: grok
Assistant-Session: 01a04cea-cb33-7c63-bad7-c1b0f9f0076b

scripts/check_layer_conformance.py

@@ -145,6 +145,11 @@ def main() -> int:
         ok = False
         print(f"FINDING: pep_shaped but {decl['pep_stance']} is missing (§6.4 / §13.1)")
 
+    classification = decl.get("evidence_bound", {}).get("classification")
+    if classification and not (ROOT / str(classification)).is_file():
+        ok = False
+        print(f"FINDING: evidence classification {classification} is missing (§9.6)")
+
     found = scan_bao_modules()
     owned = owned_modules(decl)
     undeclared = {name: lines for name, lines in found.items() if name not in owned}