Admit E3 and capacity on the test plane

Register in-process E3 and capacity fixtures, keep live database and
substrate targets pending, and ask ops-mason for namespace-only provision.
No packets, no credentials, no cancelled engagement IDs.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

targets/platform-pg-e3.json

@@ -0,0 +1,22 @@
+{
+  "schema_version": "whitehat-target/v1",
+  "target_id": "platform-pg",
+  "posture_claim": "E3",
+  "attacker_model": "E3-A omitted-predicate accident; E3-B documented SQL-compromise limit",
+  "applicability": "pending",
+  "applicability_reason": "Named in the rules of engagement as outside the initial API-probe envelope. A live run needs the database owner to confirm an ordinary runtime role without BYPASSRLS, the conformance view, and a dated window. This registration does not authorize a connection.",
+  "approval_classes": ["e3"],
+  "routes": [],
+  "identities": {
+    "count": 1,
+    "role": "ordinary runtime database role without BYPASSRLS or superuser",
+    "ttl_seconds": 900,
+    "broker_audience": "whitehat-e3/platform-pg"
+  },
+  "abort_telemetry": [
+    "statement_timeout",
+    "unexpected_or_non_fixture_data",
+    "missing_attribution",
+    "privilege_escalation"
+  ]
+}