Promote ASM T-01–T-10 into WHITEHAT-WP-0007 and triage each test

Extend whitehat-target/v1 with fixture-asm/asm instead of mapping onto
E2, E3, or capacity. Register all ten Canon tests as pending with named
blockers, known-bad designs, and result routes. Add a value-safe
conformance-message renderer. Authorizes no probe.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9

docs/test-plane.md

@@ -12,7 +12,8 @@ A live E2 run is admitted only when every item below is true:
 3. The engagement is complete, in window, owner-acknowledged, and not a
    retired ID.
 4. `approval_class` matches the registration (`fixture-e2` / `live-e2` /
-   `fixture-e3` / `e3` / `fixture-capacity` / `capacity`).
+   `fixture-e3` / `e3` / `fixture-capacity` / `capacity` / `fixture-asm` /
+   `asm`).
 5. The runner namespace is `whitehat`, the image digest is pinned, and
    engagement labels are present. Live E3 also names a `database`. Live
    capacity also names an `aggressor_ceiling`.
@@ -33,6 +34,7 @@ requested.
 - Not a secret broker. `UnconnectedCustodyBroker` is the default for every
   non-fixture environment and raises before any custody call.
 - Not a way to finish tenant-engine E2. That target is `not_applicable`.
+- Not a way to run ASM T-01…T-10. Those registrations are `pending`.
 
 ## Operator commands