MASON-WP-0009-T04 done: live capability verification of the KeyCape secrets-engine-openbao lane

Value-free evidence under the read-only ops-mason-survey grant (revoked after
use). Adds T05 for live-token checks and the pointer route. Fixes
bao-session.sh grant misreporting an unreadable policy as absent.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b

tests/test_bao_session.py

@@ -0,0 +1,41 @@
+"""bao-session.sh grant: distinguish an absent policy from an unreadable one."""
+
+import os
+import subprocess
+from pathlib import Path
+
+SCRIPT = Path(__file__).resolve().parents[1] / "scripts" / "bao-session.sh"
+
+
+def _run_grant(tmp_path, stub_stderr, stub_rc):
+    bindir = tmp_path / "bin"
+    bindir.mkdir()
+    stub = bindir / "bao"
+    stub.write_text(
+        "#!/usr/bin/env bash\n"
+        f"echo {stub_stderr!r} >&2\n"
+        f"exit {stub_rc}\n"
+    )
+    stub.chmod(0o755)
+    env = dict(os.environ)
+    env["PATH"] = f"{bindir}:{env['PATH']}"
+    env["HOME"] = str(tmp_path)
+    env["GRANT_FILE"] = str(tmp_path / "grant")
+    return subprocess.run(
+        ["bash", str(SCRIPT), "grant", "t"], env=env, capture_output=True, text=True
+    )
+
+
+def test_absent_policy_reported_as_absent(tmp_path):
+    r = _run_grant(tmp_path, "No policy named: ops-mason-survey", 2)
+    assert r.returncode == 1
+    assert "does not exist yet" in r.stdout
+    assert not (tmp_path / "grant").exists()
+
+
+def test_permission_denied_not_reported_as_absent(tmp_path):
+    r = _run_grant(tmp_path, "Code: 403. Errors: * permission denied", 2)
+    assert r.returncode == 1
+    assert "does not exist" not in r.stdout
+    assert "session expired or not permitted" in r.stdout
+    assert not (tmp_path / "grant").exists()