Add WHITEHAT-WP-0002 receipt example, CLI coverage, and abort records

Meantime polish while live E2 waits on a new trial. Example receipts carry
handles only. admit-plane --receipt is tested. Aborts can be queued without
being target assurance.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

engagements/receipts/README.md

@@ -0,0 +1,16 @@
+# Projection receipts
+
+Copy `example-projection-receipt.json` at window start and fill in the live
+engagement id, `projected_at`, `expires_at`, and identity *names* from the
+custody procedure. Never put token values, passwords, or registry payloads
+here.
+
+Live admission:
+
+```sh
+PYTHONPATH=src python3 -m whitehat_security.cli admit-plane \
+  engagements/<record>.json targets/audit-core-e2.json \
+  --receipt engagements/receipts/<engagement>.json
+```
+
+Without `--receipt`, live admission fails closed and requests no credential.

engagements/receipts/example-projection-receipt.json

@@ -0,0 +1,14 @@
+{
+  "engagement_id": "WH-ENG-EXAMPLE",
+  "projected_at": "2026-08-22T19:17:54Z",
+  "expires_at": "2099-01-01T00:00:00Z",
+  "identities": [
+    "whitehat-e2-a-example",
+    "whitehat-e2-b-example"
+  ],
+  "mounted_secret": "whitehat/whitehat-e2-audit-credentials",
+  "mounted_keys": ["token-a", "token-b"],
+  "target_image_matches": true,
+  "target_ready": true,
+  "secret_values_observed": false
+}