APTS-HO-008: require and verify control-channel delivery

[halvrenofviryel]

Closes #66.

Summary

Strengthens APTS-HO-008 by requiring operator-initiated kill instructions to be delivered to the
enforcement point under the deployment configuration in which the system operates.

Adds verification coverage for:

• end-to-end delivery across applicable network, mount, namespace, container, privilege-separation,
  and IPC boundaries
• independently observable acknowledgement, enforcement results, and explicit delivery failures
• operator notification and default-safe handling when delivery or enforcement cannot be confirmed

Following the issue review, the required behaviour is defined in the Requirement section and the two
new Verification items remain test descriptions.

Time bounds reference the Phase 1 and Phase 2 windows already defined in APTS-SC-009 rather than
introducing an implementer-defined one, so the 5- and 60-second ceilings are not relaxed.

This adds no new requirement ID, does not change the requirement count or classification, and keeps
APTS-HO-008 as MUST | Tier 1.

---

Drafted with assistance from Claude and ChatGPT. I reviewed the changes for accuracy, consistency
with the standard, and compliance with the style guide, and I take full ownership of the submission.

[halvrenofviryel]

@jinsonvarghese ready for review — thanks for the detailed steer on the issue, it made this straightforward to draft.

One thing I did that you did not ask for: The original wording said "within a defined time bound", which would have let an implementer define a third window alongside the ones APTS-SC-009 already fixes and says must not be relaxed. The requirement now references those directly: acknowledgement or explicit delivery failure in the Phase 1 window, enforcement result or explicit enforcement failure in the Phase 2 window. If you would rather HO-008 stayed silent on which phase applies, "the applicable time bounds defined in APTS-SC-009" works with no other change.

Everything else follows your review; the normative behaviour moved into the Requirement section, the two verification items are test descriptions only, and the boundary enumeration stayed in the end-to-end delivery item.

[jinsonvarghese]

LGTM. The explicit Phase 1/Phase 2 mapping is the better choice - "the applicable time bounds" would leave implementers guessing which phase applies to which observable. Acknowledgement within Phase 1 and enforcement within Phase 2 is architecturally sound, and HO-008 already cross-references SC-009 Phase 2 for the state dump window, so the pattern is consistent.

[halvrenofviryel]

Thanks for the review and the merge.