feat(v2): add secure control plane

docs/release/m2-evidence.md

@@ -19,6 +19,21 @@ Observed before implementation on 2026-07-27:
   CSRF, token, secret, audit, pagination, ETag, idempotency, readiness, and
   leakage behavior through public interfaces.
 
-## GREEN
+## GREEN — secure control plane
 
-Pending implementation.
+```bash
+make check
+.venv/bin/python -m pytest tests/unit/test_redaction.py \
+  tests/contract/test_api_conventions.py tests/integration/test_auth.py \
+  tests/security/test_auth.py tests/security/test_leakage_scan.py -q
+```
+
+Observed on 2026-07-27:
+
+- Focused M2 behavior suite: `17 passed`.
+- Complete local check: `39` unit/contract, `12` integration, and `3` security tests
+  passed; Ruff, mypy, forbidden-v1 scan, TypeScript typecheck, and frontend build passed.
+- Security tests prove Argon2id hashes, encrypted secret persistence, CSRF,
+  scoped/revoked/expired tokens, request-digest idempotency, problem details,
+  request IDs, ETags, cursor pagination, setup race handling, readiness states,
+  and output canary scanning.