Test advisory with key - #6

…t-privilege default)

…s, autonomy) with near-miss refs

…mem), fix ps1 image default to agentic_engineer_4

…val allow-list

…per not run due to role-container auth/egress, enforcement verified directly)

…ssing (5/5)

…idential denied, tied to near-misses)

…-lists (read/list + internal retrieve); verification recorded

… policy test suite passing

…n it

…in CI

…e-gate; wire into audit-trail