Admit E3 and capacity on the test plane

Register in-process E3 and capacity fixtures, keep live database and
substrate targets pending, and ask ops-mason for namespace-only provision.
No packets, no credentials, no cancelled engagement IDs.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

src/whitehat_security/cli.py

@@ -9,7 +9,7 @@ from pathlib import Path
 from .audit_fixtures import AuditFixture, audit_probe_suite
 from .capacity import CapacitySample, characterize
 from .differential import execute
-from .e3 import CADENCE, PROBES
+from .e3 import CADENCE, PROBES, e3_calibration
 from .engagement import AuthorizationError, Engagement
 from .fixtures import FixtureService, probe_suite
 from .model import RunReport, utc_now
@@ -95,6 +95,8 @@ def main(argv: list[str] | None = None) -> None:
     deliver.add_argument("report")
     deliver.add_argument("--outbox", default="outbox")
     commands.add_parser("e3-plan")
+    e3_fix = commands.add_parser("e3-fixtures", help="calibrate E3 probes offline")
+    e3_fix.add_argument("--output")
     commands.add_parser("capacity-fixture")
     message = commands.add_parser("risk-message")
     message.add_argument("report")
@@ -164,6 +166,14 @@ def main(argv: list[str] | None = None) -> None:
         print(json.dumps({"cadence": CADENCE, "probes": [asdict(probe) for probe in PROBES]},
                          indent=2, sort_keys=True))
         return
+    if args.command == "e3-fixtures":
+        result = e3_calibration()
+        rendered = json.dumps(result, indent=2, sort_keys=True) + "\n"
+        if args.output:
+            Path(args.output).write_text(rendered, encoding="utf-8")
+        else:
+            print(rendered, end="")
+        raise SystemExit(0 if result["outcome"] == "pass" else 1)
     if args.command == "capacity-fixture":
         print(json.dumps(capacity_fixture(), indent=2, sort_keys=True))
         return