Milestone 5: add executable behavioral scenarios

[anthfuller]

Summary

• add an executable manifest containing 11 canonical behavioral scenarios
• exercise real OPA permit and deny paths plus malformed, unauthorized, unavailable, timeout, tampering, obligation, expiry, and recovery behavior
• require valid canonical evidence and no reported side effects for accepted attempts
• verify admission refusals return exit code 2 without emitting workflow records
• expose behavioral scenarios as a distinct CI gate

Validation

• 11 behavioral scenarios plus 1 manifest-integrity test passed
• 51 existing tests passed; 63 total
• official OPA 1.20.2 strict validation passed
• prompt, policy, allowlist, settings, contract, and golden-dataset validation passed
• historical whitepaper remains unchanged

Reviewed head: 00216d3fa05e20ebb1eeac6ec8129f8f462a13b7

Do not merge until GitHub Actions passes and final independent review approves the unchanged head.