WARDEN-WP-0026 T02: safe access transports (no secret values on stdout)

- proxy.py: proxy_fetch_to_file (mode-0600 file), build_wrapped_fetch +
  proxy_fetch_wrapped (single-use OpenBao response-wrapping token), _capture_value
  helper, is_bao_kv_fetch.
- warden access: --out FILE, --wrap [--wrap-ttl], --unsafe-stdout. Raw --fetch to a
  non-TTY stdout is refused (exit 6) — captured/piped output is the disclosure risk;
  sanctioned transports are --out / --exec / --wrap.
- canon: anti-pattern (secret value onto captured stdout) + transport table in
  .claude/rules/credential-routing.md; OperatorAccessAssist.md examples + G2 updated.
- tests: file/wrap/build + stdout-guard in tests/test_proxy.py. 293 pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md

@@ -88,11 +88,20 @@ it (see T07).
 
 ```task
 id: WARDEN-WP-0026-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "3f28c573-8e58-4851-8aa0-925f9367f266"
 ```
 
+Done 2026-07-16: sanctioned transports added to `warden access` so a value never
+lands on stdout — `--out FILE` (mode-0600 file), `--exec` (child env, pre-existing),
+and `--wrap` (single-use OpenBao response-wrapping token via `bao kv get -wrap-ttl`,
+caller `bao unwrap`s in their own context). Raw `--fetch` to a non-TTY stdout is now
+refused (exit 6) unless `--unsafe-stdout` is passed (interactive human only).
+`proxy_fetch_to_file`/`proxy_fetch_wrapped`/`build_wrapped_fetch` in `proxy.py`; tests
+in `tests/test_proxy.py`. Anti-pattern + transports documented fleet-wide in
+`.claude/rules/credential-routing.md` and `wiki/OperatorAccessAssist.md` (G2).
+
 `warden access` / fetch paths must emit values only into an env var, a file, or
 a **response-wrapping token** (`bao … -wrap-ttl`), never a stdout table. Add a
 wrapping-token transport for values that must move between processes. Record in