Admit live E2 from a value-safe custody receipt

WH-ENG-20260822-AUDIT-E2-02 projected and then aborted: admit-plane had no
receipt adapter, so the runner sent zero packets. Consume custody receipts
as handles only, keep unconnected admission fail-closed, and retire -02.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

src/whitehat_security/cli.py

@@ -13,7 +13,7 @@ from .e3 import CADENCE, PROBES, e3_calibration
 from .engagement import AuthorizationError, Engagement
 from .fixtures import FixtureService, probe_suite
 from .model import RunReport, utc_now
-from .plane import KillSwitch, admit, default_broker, retired_ids
+from .plane import KillSwitch, ReceiptBroker, admit, default_broker, retired_ids
 from .reporting import queue_risk_nexus, risk_nexus_message
 from .targets import load_catalog, load_registration
 
@@ -90,6 +90,7 @@ def main(argv: list[str] | None = None) -> None:
     admit_plane = commands.add_parser("admit-plane")
     admit_plane.add_argument("engagement")
     admit_plane.add_argument("registration")
+    admit_plane.add_argument("--receipt", help="value-safe custody projection receipt")
     commands.add_parser("kill-switch")
     deliver = commands.add_parser("deliver")
     deliver.add_argument("report")
@@ -138,8 +139,11 @@ def main(argv: list[str] | None = None) -> None:
         try:
             record = Engagement.load(args.engagement)
             registration = load_registration(args.registration)
+            broker = (
+                ReceiptBroker.load(args.receipt) if args.receipt else default_broker(record)
+            )
             lease = admit(engagement=record, registration=registration,
-                          broker=default_broker(record), kill_switch=KillSwitch(),
+                          broker=broker, kill_switch=KillSwitch(),
                           retired=retired_ids())
         except (AuthorizationError, OSError, ValueError, json.JSONDecodeError) as error:
             print(f"not authorized: {error}", file=sys.stderr)