PR Template - Sprint 19 Task 02

Task

Reject unsigned configuration at startup.

Summary

• Added explicit rejection path for invalid or missing startup signatures.

Scope

• src/pkg/orchestrator/control_plane_integrity.py
• tests/unit/test_control_plane_integrity.py

Validation

• PYTHONPATH=src .venv/bin/pytest -q tests/unit/test_control_plane_integrity.py -k invalid_signature