Add in-process known-bad fixtures for remaining ASM T-01–T-10

Each Canon test now has a fixture-asm registration that fails known-bad
and passes known-good in-process. Live asm-tNN targets stay pending.
No network, OpenBao, or packet.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9

tests/test_asm.py

@@ -2,7 +2,7 @@ import json
 
 import pytest
 
-from whitehat_security.asm import t06_calibration, t06_results
+from whitehat_security.asm import CALIBRATORS, asm_calibration, t06_calibration, t06_results
 from whitehat_security.cli import main
 
 
@@ -41,7 +41,20 @@ def test_asm_fixtures_cli_writes_t06(tmp_path):
     assert report["test_id"] == "T-06"
 
 
-def test_asm_fixtures_cli_refuses_unterminated_test():
+@pytest.mark.parametrize("test_id", [key for key in CALIBRATORS if key != "T-06"])
+def test_remaining_asm_calibrations_fail_known_bad(test_id):
+    report = asm_calibration(test_id)
+    assert report["outcome"] == "pass"
+    assert report["evidence_class"] == "fixture"
+    assert report["test_id"] == test_id
+    assert any(item["outcome"] == "finding" for item in report["known_bad"])
+    assert all(item["outcome"] == "pass" for item in report["known_good"])
+    blob = json.dumps(report)
+    assert "sk-whitehat-t02-not-a-real-secret" not in blob
+    assert "whitehat-t06-synthetic" not in blob
+
+
+def test_asm_fixtures_cli_refuses_unknown_test():
     with pytest.raises(SystemExit) as stopped:
-        main(["asm-fixtures", "--test-id", "T-01"])
+        main(["asm-fixtures", "--test-id", "T-99"])
     assert stopped.value.code == 2