Fail closed on unresolved upgrade admission decisions

[bringhurst]

Live preflight accepted any nonempty disposition with an owner and evidence string. A client-floor marked blocked or merely retained could therefore produce kind=live-admission, passed=true. Truthy non-string fields and unknown extra decision keys were also accepted.

Require explicit dispositions:

• inspected ZooKeeper paths: retained or unused;
• remote storage: unused;
• plugin state: unused or qualified;
• client floor: qualified-unchanged;
• artifact admission: bridge-artifacts-only.

Reject unknown keys, unresolved/free-form dispositions, and blank or non-string owner/evidence fields. Packaged runtime version and qualification evidence must also be nonblank strings. The contract-2 JSON shape is unchanged; formerly permissive values no longer grant admission. The new guide defines the tokens and provides a deliberately non-admissible template.

This does not choose or change a client configuration. F28's inherited bootstrap limitation must be covered in the owner's exact client-floor evidence and SLOs. If that unchanged profile is unqualified, production admission stays blocked. The separate zero-expiry experiment is not silently adopted. These declarations do not authenticate an approver or prove the linked tests; the guide states that trust boundary.

Evidence: before tests reproduce successful CLI admission for blocked and retained client floors. After the fix, both return failure and only explicit qualified evidence passes. Tests cover every required decision, field types, unknown keys, valid alternatives, CLI result kind/status and the empty template. All 93 Python tests and actual RAT pass. No Kafka runtime, client profile, deadline or record assertion is changed.

Based on #599. This is upgrade admission tooling, not a CI-foundation change.

[bringhurst]

The failed process job is a fixture-orchestration bug, not a broker or client-bootstrap error. The CLI refused the fixture reassignment with Cannot execute because there is an existing partition assignment. The unrelated continuous-churn topic legitimately still had a move pending while broker 0 was offline. The retained artifact's source/helper fingerprints match this PR.

#601 supplies --additional for the exact fixture file. Cancellation keeps its 1024-byte/s broker rates but sets only its own topic selectors: using CLI --throttle alongside existing moves would rewrite their selectors too. No record/ISR check, client profile, retry policy or deadline is relaxed.

A deterministic real-broker probe now keeps another reassignment pending, reproduces the original CLI refusal, then runs the actual corrected helper. The unrelated assignment and topic throttle stay unchanged, and cancelled-topic records verify exactly. The scoped probe remains marked as an incomplete migration. The complete updated process is running; this failed job is retained and is not relabelled as a pass.