Add governed test plane and close T04/T08

Encode fail-closed admission, target registrations, and a credential
broker that never returns secret values. Calibrate audit-core shaped
probes in-process. Send no packets and request no live credentials.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

engagements/README.md

@@ -9,3 +9,8 @@ or route.
 An engagement record contains authorization metadata only. Never put a token,
 password, database URL, secret path value, or real tenant identifier here.
 
+Live admission also requires a matching file in `targets/` and a plane lease
+from `whitehat admit-plane`. `WH-ENG-20260821-AUDIT-E2` and
+`WH-ENG-20260821-TENANT-E2` are cancelled and must not be reused. The pod
+manifest under `runtime/` is bound to a cancelled ID and must not be applied.
+

engagements/runtime/README.md

@@ -0,0 +1,4 @@
+The `audit-core-e2-pod.yaml` manifest is bound to cancelled engagement
+`WH-ENG-20260821-AUDIT-E2`. Do not apply it. New live runs use
+`plane/runner-pod.yaml` with a new unretired engagement ID after the plane
+exists.

engagements/template.json

@@ -5,10 +5,14 @@
   "approved_at": "YYYY-MM-DDTHH:MM:SSZ",
   "expires_at": "YYYY-MM-DDTHH:MM:SSZ",
   "target": "https://target.example.invalid",
+  "target_id": "registered-target-id",
   "target_owner": "responsible repo or party",
   "target_owner_acknowledged_at": "YYYY-MM-DDTHH:MM:SSZ",
   "environment": "build",
-  "namespace": "namespace if applicable",
+  "approval_class": "live-e2",
+  "plane_namespace": "whitehat",
+  "runner_image_digest": "sha256:pin-me",
+  "namespace": "whitehat",
   "source": "probe source and network position",
   "routes": ["GET /exact/in-scope/route"],
   "fixture_ids": ["synthetic-tenant-a", "synthetic-tenant-b"],
@@ -19,6 +23,7 @@
   "prohibited_techniques": ["discovery", "saturation", "real-data collection"],
   "rate_limit_per_minute": 10,
   "max_concurrency": 1,
+  "maximum_requests": 30,
   "window_start": "YYYY-MM-DDTHH:MM:SSZ",
   "window_end": "YYYY-MM-DDTHH:MM:SSZ",
   "operator_contact": "operator contact",