Promote ASM T-01–T-10 into WHITEHAT-WP-0007 and triage each test

Extend whitehat-target/v1 with fixture-asm/asm instead of mapping onto
E2, E3, or capacity. Register all ten Canon tests as pending with named
blockers, known-bad designs, and result routes. Add a value-safe
conformance-message renderer. Authorizes no probe.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9

src/whitehat_security/targets.py

@@ -45,6 +45,10 @@ def load_registration(path: str | Path) -> dict[str, Any]:
             raise AuthorizationError(f"{path}: E3 registration must project one runtime identity")
         if classes & {"fixture-capacity", "capacity"} and count not in {0, 1}:
             raise AuthorizationError(f"{path}: capacity registration projects at most one aggressor identity")
+        if classes & {"fixture-asm", "asm"} and count not in {0, 1, 2}:
+            raise AuthorizationError(f"{path}: ASM registration projects at most two identities")
+        if classes & {"fixture-asm", "asm"} and not data.get("test_id"):
+            raise AuthorizationError(f"{path}: ASM registration must preserve a Canon test_id")
         if count and identities.get("ttl_seconds", 0) > 900:
             raise AuthorizationError(f"{path}: identity TTL must be at most 900 seconds")
         if data.get("known_bad_calibration") in {None, "", "pending"}: