Report engagement denials without tracebacks

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0260c-4067-7052-9647-ad000d576e38

tests/test_cli.py

@@ -0,0 +1,14 @@
+import json
+
+import pytest
+
+from whitehat_security.cli import main
+
+
+def test_validate_engagement_reports_clean_denial(tmp_path, capsys):
+    path = tmp_path / "pending.json"
+    path.write_text(json.dumps({}), encoding="utf-8")
+    with pytest.raises(SystemExit) as stopped:
+        main(["validate-engagement", str(path)])
+    assert stopped.value.code == 2
+    assert capsys.readouterr().err.startswith("not authorized:")