test(v2): define secure control-plane contracts

tests/security/test_leakage_scan.py

@@ -0,0 +1,26 @@
+from __future__ import annotations
+
+import subprocess
+import sys
+
+
+def test_leakage_scan_rejects_canary_and_accepts_clean_file(tmp_path) -> None:
+    path = tmp_path / "output.txt"
+    path.write_text("safe output", encoding="utf-8")
+    clean = subprocess.run(
+        [sys.executable, "tools/leakage_scan.py", "--canary", "secret-canary", str(path)],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    assert clean.returncode == 0
+
+    path.write_text("oops secret-canary escaped", encoding="utf-8")
+    leaked = subprocess.run(
+        [sys.executable, "tools/leakage_scan.py", "--canary", "secret-canary", str(path)],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    assert leaked.returncode == 1
+    assert "output.txt" in leaked.stdout