Prepare receipt-bound audit E2 third attempt

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de

engagements/runtime/whitehat-e2-audit-20260822-03.yaml

@@ -0,0 +1,51 @@
+# CONTRACT ONLY. Do not apply until WP-0025 projection and admit-plane succeed.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: whitehat-e2-audit-03
+  namespace: whitehat
+  labels:
+    app.kubernetes.io/name: whitehat-security
+    app.kubernetes.io/component: whitehat-probe
+    whitehat.security/plane: "true"
+    whitehat.security/target: audit-core
+    whitehat.security/engagement: WH-ENG-20260822-AUDIT-E2-03
+spec:
+  serviceAccountName: whitehat-runner
+  automountServiceAccountToken: false
+  activeDeadlineSeconds: 900
+  restartPolicy: Never
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 10001
+    runAsGroup: 10001
+    fsGroup: 10001
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+    - name: probe
+      image: forgejo.coulomb.social/coulomb/audit-core@sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6
+      imagePullPolicy: IfNotPresent
+      command: ["sleep", "900"]
+      resources:
+        requests: {cpu: 5m, memory: 16Mi}
+        limits: {cpu: 50m, memory: 64Mi}
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop: ["ALL"]
+        readOnlyRootFilesystem: true
+      volumeMounts:
+        - name: credentials
+          mountPath: /var/run/secrets/whitehat
+          readOnly: true
+  volumes:
+    - name: credentials
+      secret:
+        secretName: whitehat-e2-audit-credentials-03
+        defaultMode: 0440
+        items:
+          - key: token-a
+            path: token-a
+          - key: token-b
+            path: token-b