Add governed test plane and close T04/T08

Encode fail-closed admission, target registrations, and a credential
broker that never returns secret values. Calibrate audit-core shaped
probes in-process. Send no packets and request no live credentials.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

src/whitehat_security/reporting.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import json
 from pathlib import Path
 
+from .engagement import AuthorizationError
 from .model import RunReport
 
 
@@ -29,3 +30,14 @@ def risk_nexus_message(report: RunReport) -> str:
         lines.extend(["", "Reporter supplies facts only; risk-nexus owns severity and disclosure."])
     return "\n".join(lines) + "\n"
 
+
+def queue_risk_nexus(report: RunReport, outbox: str | Path) -> Path:
+    """Persist a delivery artifact. Fixture calibration is not target assurance."""
+    if report.evidence_class != "target":
+        raise AuthorizationError("fixture evidence is not delivered as target assurance")
+    directory = Path(outbox)
+    directory.mkdir(parents=True, exist_ok=True)
+    path = directory / f"{report.run_id}.md"
+    path.write_text(risk_nexus_message(report), encoding="utf-8")
+    return path
+