Beachhead stub
Approved Integration Boundary (CC9.2 allowlist). Admin CRUD later — no ad-hoc connectors in Prod.
Allowlist empty — beachhead stub. Do not add arbitrary MCP or vendor hooks here yet.