PR Template - Sprint 19 Task 03

Task

Enforce OPA policy hash pinning.

Summary

• Added OPA_POLICY_PINNED_SHA256 startup integrity pin validation.

Scope

• src/pkg/orchestrator/control_plane_integrity.py
• tests/unit/test_control_plane_integrity.py

Validation

• PYTHONPATH=src .venv/bin/pytest -q tests/unit/test_control_plane_integrity.py -k policy_pin