feat(safe-exec): template safe-exec postures and wire ROE hosts

[pshickeydev]

Summary

• Make restricted validation usable for per-engagement cluster endpoints through explicit HTTP authorization, scope-checked route/node discovery, and isolated execution state.
• Replace generated HTTP shell workflows with structured requests and adapter-managed tunnels, preserving authorization and authentication preconditions through execution and reporting.

Included changes

• Template and document the security postures; default the example to baseline with restricted validation and an empty static host list. Bind estate profiles through the application composition root. Add --allowed-host to the utility CLI and display posture in profile listings.
• Add explicit-only http_targets and per-cluster http_discovery policy. Route namespaces, resource names, approved domains, node networks, and credential permissions remain engagement data rather than permissions inferred from findings.
• Resolve the selected kubeconfig context's API and reject mismatches. Apply expiry, resource, namespace, and verb checks to discovery and selected endpoints. Direct structured API requests are limited to health/version endpoints.
• Use per-run adapter instances. Structured requests supply the selected endpoint to safe-exec; command-text requests retain the declared engagement host list. Loopback is no longer an engagement-wide grant: tunnels own their local port, readiness deadline, and cleanup.
• Resolve Service target ports to selected Pods, choose transport from Service metadata or an explicit request, and preserve the Service DNS identity for TLS through an owned tunnel. Support operator-configured CAs and an explicit lab TLS exception; bypass proxy routing for structured requests.
• Keep generated probes anonymous unless explicitly configured otherwise. Authenticated CSRF requests require a configured identity check. Preserve session cookie names, keep private headers off process arguments, and redact reflected request secrets before evidence is stored.
• Recheck HTTP method classification, reject command/rollback text on structured requests, and report policy refusals separately from inconclusive resolution/session failures.
• Add validated external-data models, shared ROE-generation helpers, documentation, and regression coverage including real local HTTP/TLS requests.

Boundaries

The engine host gate is not port/path isolation or a DNS-rebinding defense. Resource-specific grants are enforced by structured resolution, not by the raw command-text host list. Operator-approved discovery boundaries remain necessary. Interactive console OAuth login is not implemented; unsatisfied authenticated-session preconditions remain inconclusive.

Verification

• Latest full consumer run: 2,433 passed, 54 skipped, 1 failure. The remaining failure is the pre-existing, unrelated skill-alignment rule rejecting broad Git permissions in the patch skill.
• After the final node-command regression additions: 88 passed across HTTP endpoint/review and validation-scope regression tests.
• Changed-code Ruff checks and git diff --check passed.
• Local transport tests exercise proxy exclusion, HEAD handling, TLS Service identity, credential/session handling, and redaction. They are not substitutes for authorized live-cluster acceptance.

Merge prerequisites

1. Merge and tag engine #8.
2. Update this repository's engine dependency pin and lockfile to that release; this PR still carries the previous pin.
3. Deploy the matching package and skill tree, then run authorized operator/core smoke tests with explicit policies before enabling estate #6.

Description prepared with AI assistance.

---

Recreated from #26. The source fork was deleted and re-forked as part of a repository
cleanup, which auto-closed the original PR and left its head ref unrecoverable. Branch
content is byte-identical to #26 at f33b98f.

Disclosure: this footer was drafted by an AI assistant (Claude). The PR description above
is the original author's text, restored verbatim from a pre-deletion backup.