feat(nono): add isolated evidence harness

tests/nono/fixtures/core/broad.json

@@ -0,0 +1,9 @@
+{
+  "extends": "default",
+  "workdir": {
+    "access": "readwrite"
+  },
+  "network": {
+    "block": false
+  }
+}

tests/nono/fixtures/core/data.txt

@@ -0,0 +1 @@
+safe fixture data

tests/nono/fixtures/core/minimal.json

@@ -0,0 +1,9 @@
+{
+  "extends": "default",
+  "workdir": {
+    "access": "none"
+  },
+  "network": {
+    "block": true
+  }
+}

tests/nono/fixtures/core/probe.py

@@ -0,0 +1,4 @@
+#!/usr/bin/env python3
+"""Safe fixture probe: prints only its fixed, non-secret result."""
+
+print("nono-fixture-probe: ok")