Propose WH-ENG-20260822-AUDIT-E2-01 without authorizing traffic

Align plane ordering with Mason's apply, record the fresh audit-core
engagement as proposed, and keep offline admission fail-closed until
operator approval and owner acknowledgement exist.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

src/whitehat_security/engagement.py

@@ -39,6 +39,10 @@ class Engagement:
     def validate(self, *, now: datetime | None = None) -> None:
         if self.raw.get("status") == "cancelled":
             raise AuthorizationError("engagement is cancelled")
+        if self.raw.get("status") == "proposed":
+            raise AuthorizationError(
+                "engagement is proposed; operator approval and owner acknowledgement are pending"
+            )
         current = now or datetime.now(UTC)
         start = _timestamp(self.raw["window_start"])
         end = _timestamp(self.raw["window_end"])