Add governed test plane and close T04/T08

Encode fail-closed admission, target registrations, and a credential
broker that never returns secret values. Calibrate audit-core shaped
probes in-process. Send no packets and request no live credentials.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

targets/fixture-e2.json

@@ -0,0 +1,37 @@
+{
+  "schema_version": "whitehat-target/v1",
+  "target_id": "fixture-e2",
+  "posture_claim": "E2",
+  "attacker_model": "E2-authenticated-tenant-a",
+  "applicability": "applicable",
+  "applicability_reason": "In-process known-good/known-bad service created by this repository. It instantiates tenant A with no tenant B authority.",
+  "approval_classes": ["fixture-e2"],
+  "adapter": "src/whitehat_security/fixtures.py",
+  "probe_pack": "src/whitehat_security/fixtures.py",
+  "known_bad_calibration": "src/whitehat_security/fixtures.py",
+  "fixture_lifecycle": {
+    "create": "in-process constructor",
+    "delete": "drop process state",
+    "ids_are_synthetic": true
+  },
+  "egress": "in-process",
+  "routes": [
+    "GET /objects/{id}",
+    "GET /objects?tenant={tenant_id}",
+    "POST /objects",
+    "PATCH /objects/{id}",
+    "DELETE /objects/{id}"
+  ],
+  "identities": {
+    "count": 2,
+    "role": "ordinary tenant-scoped fixture actor",
+    "ttl_seconds": 900,
+    "broker_audience": "whitehat-e2/fixture"
+  },
+  "abort_telemetry": [
+    "p95_latency_ms",
+    "probe_attributable_5xx",
+    "unexpected_or_non_fixture_data",
+    "missing_attribution"
+  ]
+}