access-engine: secret-read evaluator for warden fetch checks (CUST-WP-0075)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3

examples/ops-warden-fetch/check_request_deny_wrong_system.json

@@ -0,0 +1,20 @@
+{
+  "id": "check:ops-warden-fetch-forgejo-admin-api-token",
+  "subject": {
+    "id": "operator",
+    "type": "operator",
+    "tenant": "tenant:platform"
+  },
+  "action": "read",
+  "resource": {
+    "id": "secret:forgejo-admin-api-token",
+    "type": "secret",
+    "system": "key-cape",
+    "tenant": "tenant:platform"
+  },
+  "context": {
+    "need_id": "forgejo-admin-api-token",
+    "owner_repo": "key-cape",
+    "domain": null
+  }
+}