test(v2): define secure control-plane contracts

docs/release/m2-evidence.md

@@ -0,0 +1,24 @@
+# M2 TDD Evidence
+
+## RED — behavioral contracts absent
+
+Commit command:
+
+```bash
+.venv/bin/python -m pytest tests/unit/test_redaction.py \
+  tests/contract/test_api_conventions.py tests/integration/test_auth.py \
+  tests/security/test_auth.py tests/security/test_leakage_scan.py -q
+```
+
+Observed before implementation on 2026-07-27:
+
+- Exit: `1`
+- Result: `4 failed, 13 errors`
+- Intended causes: `backup_tool.api`, `backup_tool.security`, and
+  `tools/leakage_scan.py` did not exist. Tests described setup, authentication,
+  CSRF, token, secret, audit, pagination, ETag, idempotency, readiness, and
+  leakage behavior through public interfaces.
+
+## GREEN
+
+Pending implementation.