feat: harden zone reference contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

fixtures/exceptions/invalid-overlap.yaml

@@ -0,0 +1,30 @@
+standard: security-zone-exceptions_v0.1
+exceptions:
+  - exception_id: zone-exc-fixture-001
+    security_zone: z2-protected
+    control: flex-auth/pre-sign
+    workloads: [issue-core]
+    base: {stance: enforced, failure_mode: fail_closed}
+    relaxation: {stance: advisory}
+    justification: first overlapping fixture
+    requested_by: issue-core
+    granted_by: ops-warden/security-owner
+    issued_at: "2026-08-23T09:00:00Z"
+    not_before: "2026-08-23T10:00:00Z"
+    not_after: "2026-08-23T12:00:00Z"
+    maximum_duration_policy: ops-warden/security-zone-exceptions@1
+    change_ref: ops-warden@fixture-1
+  - exception_id: zone-exc-fixture-002
+    security_zone: z2-protected
+    control: flex-auth/pre-sign
+    workloads: [issue-core]
+    base: {stance: enforced, failure_mode: fail_closed}
+    relaxation: {stance: advisory}
+    justification: second overlapping fixture
+    requested_by: issue-core
+    granted_by: ops-warden/security-owner
+    issued_at: "2026-08-23T09:30:00Z"
+    not_before: "2026-08-23T11:00:00Z"
+    not_after: "2026-08-23T12:30:00Z"
+    maximum_duration_policy: ops-warden/security-zone-exceptions@1
+    change_ref: ops-warden@fixture-2

fixtures/exceptions/policy.yaml

@@ -0,0 +1,8 @@
+standard: security-zone-exception-policy_v0.1
+policy_id: ops-warden/security-zone-exceptions
+version: "1"
+controls:
+  flex-auth/pre-sign:
+    grant_authorities:
+      - ops-warden/security-owner
+    maximum_duration_seconds: 7200

fixtures/exceptions/valid-active.yaml

@@ -0,0 +1,19 @@
+standard: security-zone-exceptions_v0.1
+exceptions:
+  - exception_id: zone-exc-fixture-001
+    security_zone: z2-protected
+    control: flex-auth/pre-sign
+    workloads: [issue-core]
+    base: {stance: enforced, failure_mode: fail_closed}
+    relaxation: {stance: advisory}
+    justification: bounded migration fixture
+    requested_by: issue-core
+    granted_by: ops-warden/security-owner
+    issued_at: "2026-08-23T09:00:00Z"
+    not_before: "2026-08-23T10:00:00Z"
+    not_after: "2026-08-23T12:00:00Z"
+    maximum_duration_policy: ops-warden/security-zone-exceptions@1
+    change_ref: ops-warden@fixture
+    durable_authorities:
+      - id: ssh-cert:fixture
+        not_after: "2026-08-23T11:00:00Z"