WARDEN-WP-0026 T02: safe access transports (no secret values on stdout)

- proxy.py: proxy_fetch_to_file (mode-0600 file), build_wrapped_fetch +
  proxy_fetch_wrapped (single-use OpenBao response-wrapping token), _capture_value
  helper, is_bao_kv_fetch.
- warden access: --out FILE, --wrap [--wrap-ttl], --unsafe-stdout. Raw --fetch to a
  non-TTY stdout is refused (exit 6) — captured/piped output is the disclosure risk;
  sanctioned transports are --out / --exec / --wrap.
- canon: anti-pattern (secret value onto captured stdout) + transport table in
  .claude/rules/credential-routing.md; OperatorAccessAssist.md examples + G2 updated.
- tests: file/wrap/build + stdout-guard in tests/test_proxy.py. 293 pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/rules/credential-routing.md

@@ -39,6 +39,22 @@ Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run wa
 - `POST /messages/` to `ops-warden` asking for `ISSUE_CORE_API_KEY`, `OPENROUTER_API_KEY`, etc.
 - Inventing `warden secret`, `warden login`, `warden bao`, `warden tunnel` — they do not exist
 - Pasting secrets into Git, State Hub, workplans, logs, or chat
+- **Reading a secret value onto a captured stdout.** `bao kv get <path>` (full table)
+  or `bao kv get -field=X` piped/redirected/run in an agent session dumps the value
+  into a logged context — the 2026-07-16 disclosure. To *verify* a lane use
+  `bao token capabilities` (allow/deny), never a read (WP-0026 T01).
+
+### Safe fetch transports (WP-0026 T02)
+
+When a value must actually move, use a sanctioned transport that keeps it off
+stdout. `warden access <need> --fetch` refuses to stream a value to a non-terminal
+stdout unless you pass `--unsafe-stdout` (interactive human sessions only):
+
+| Transport | Command | Result |
+| --- | --- | --- |
+| **File** | `warden access <need> --out FILE` | value written to a mode-0600 file, never shown |
+| **Env (exec)** | `warden access <need> --exec -- <cmd>` | value injected into the child process env only |
+| **Wrapping token** | `warden access <need> --wrap` | a single-use, short-TTL OpenBao wrapping token to `bao unwrap` in your own context |
 
 ### Other capabilities (reuse-surface)