feat: enforce signed target maturity evidence

tools/assessments/capability-fit.py

@@ -20,9 +20,11 @@ for tools_root in (ASSESSMENT_TOOLS_ROOT, RELEASE_TOOLS_ROOT):
 
 from govoplan_assessment import (  # noqa: E402
     collect_installed_composition,
+    enforce_required_boundary_scopes,
     render_review,
     review_capability_fit,
 )
+from govoplan_assessment.evidence import REFERENCE_READINESS_SCOPES  # noqa: E402
 from govoplan_assessment.atomic_io import (  # noqa: E402
     AtomicJsonWriteError,
     atomic_write_json,
@@ -169,6 +171,21 @@ def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
             "never supply a URL, credential, or endpoint identifier."
         ),
     )
+    parser.add_argument(
+        "--require-reference-readiness",
+        action="store_true",
+        help="Fail unless every reference-readiness boundary scope is current and positive.",
+    )
+    parser.add_argument(
+        "--require-external-provider-proof",
+        action="store_true",
+        help="Fail unless current positive external-provider evidence is present.",
+    )
+    parser.add_argument(
+        "--require-production-approval",
+        action="store_true",
+        help="Fail unless a current explicit production approval is present.",
+    )
     parser.add_argument(
         "--json", action="store_true", help="Print the machine-readable review report."
     )
@@ -377,6 +394,17 @@ def main(argv: list[str] | None = None) -> int:
         ),
         expected_external_provider_subject=args.expected_external_provider_subject,
     )
+    required_boundary_scopes: set[str] = set()
+    if args.require_reference_readiness:
+        required_boundary_scopes.update(REFERENCE_READINESS_SCOPES)
+    if args.require_external_provider_proof:
+        required_boundary_scopes.add("external_providers")
+    if args.require_production_approval:
+        required_boundary_scopes.add("production_approval")
+    if required_boundary_scopes:
+        enforce_required_boundary_scopes(
+            report, required_scopes=required_boundary_scopes
+        )
     encoded = json.dumps(report, indent=2, sort_keys=True) + "\n"
     if args.output is not None:
         write_object(