ssh-certificates pack: use ops-warden's rehearsal config (WARDEN_CONFIG); record dry-run

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 6969@bnt-lap001
Assistant-Session: e8ae73f2-8385-4c9c-b714-94c3c52cdbc0

runbooks/ssh-certificates/pack.yaml

@@ -22,6 +22,13 @@ datapoints:
     help: "Actor type prefix decides the maximum TTL: adm 48h, agt 24h, atm 8h. agt-rehearsal is an inert test actor (2h, a principal no host trusts); use your own actor for real access."
     dimensions: {actor: operator, kind: identity, subsystem: ops-warden}
     ask_in: ready
+  - id: warden_config
+    label: warden config file
+    type: path
+    default: ~/.config/warden/rehearsal/warden.yaml
+    help: The rehearsal config uses a throwaway local CA that nothing trusts and has no flex-auth gate, so it proves the signing mechanics, not the policy gate. For real access use your production config, ~/.config/warden/warden.yaml.
+    dimensions: {actor: operator, kind: location, subsystem: ops-warden}
+    ask_in: ready
   - id: pubkey
     label: Public key path
     type: path
@@ -62,7 +69,8 @@ stages:
         actor: operator
         owner: ops-warden
         requires: [prerequisites]
-        command: warden status
+        uses: [warden_config]
+        command: WARDEN_CONFIG={{warden_config}} warden status
         idempotent: idempotent
         verify:
           done_when: You know which certificates are current and which are expired
@@ -76,8 +84,8 @@ stages:
         title: Sign a public key for the actor
         actor: operator
         owner: ops-warden
-        uses: [actor_name, pubkey]
-        command: warden sign {{actor_name}} --pubkey {{pubkey}} > /tmp/{{actor_name}}-cert.pub
+        uses: [actor_name, pubkey, warden_config]
+        command: WARDEN_CONFIG={{warden_config}} warden sign {{actor_name}} --pubkey {{pubkey}} > /tmp/{{actor_name}}-cert.pub
         idempotent: idempotent
         idempotent_note: Each run issues a new certificate and overwrites the file; the old one expires on its own.
         rollback: Delete /tmp/{{actor_name}}-cert.pub; the certificate expires on its own.
@@ -143,7 +151,8 @@ stages:
         actor: operator
         owner: ops-warden
         requires: [tunnel-up]
-        command: warden log | tail -5
+        uses: [warden_config]
+        command: WARDEN_CONFIG={{warden_config}} warden log | tail -5
         idempotent: idempotent
         verify:
           done_when: Your signing appears in the history