Add governed test plane and close T04/T08

Encode fail-closed admission, target registrations, and a credential
broker that never returns secret values. Calibrate audit-core shaped
probes in-process. Send no packets and request no live credentials.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

schemas/target-registration.schema.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "whitehat-target/v1",
+  "type": "object",
+  "additionalProperties": true,
+  "required": [
+    "schema_version", "target_id", "posture_claim", "attacker_model",
+    "applicability", "applicability_reason", "approval_classes", "routes",
+    "identities", "abort_telemetry"
+  ],
+  "properties": {
+    "schema_version": {"const": "whitehat-target/v1"},
+    "applicability": {"enum": ["applicable", "not_applicable", "pending"]},
+    "approval_classes": {
+      "type": "array",
+      "minItems": 1,
+      "items": {"enum": ["fixture-e2", "live-e2", "e3", "capacity"]}
+    },
+    "routes": {"type": "array", "items": {"type": "string"}},
+    "identities": {
+      "type": "object",
+      "properties": {
+        "count": {"const": 2},
+        "ttl_seconds": {"type": "integer", "minimum": 1, "maximum": 900}
+      }
+    }
+  }
+}