Kernel integration tests

[dgenio]

Summary

End-to-end integration tests for the Kernel using InMemoryDriver.

Tests in tests/test_kernel.py

1. Happy path: register capabilities + driver → request → grant → invoke → verify Frame has facts/handles → expand handle → verify expanded data → explain action → verify trace
2. Policy denial: attempt WRITE without writer role → catch PolicyDenied → verify denial_reason
3. Expired token: issue token with ttl=0 → sleep briefly or mock time → invoke → catch TokenExpired
4. Driver fallback: register two implementations, first raises DriverError → kernel falls back to second → success
5. PII redaction in full flow: invoke capability with PII sensitivity → verify redacted fields in Frame → verify warning

Acceptance criteria

• All 5 test scenarios implemented and passing
• Tests use conftest fixtures for registry + kernel setup