WARDEN: separate fetch evaluator URL for secret-read checks (CUST-WP-0075)

check_fetch_policy now posts only to policy.fetch_flex_auth_url (access-engine
pin flex-auth-ops-warden-fetch, workstation 127.0.0.1:19091). Signing keeps
policy.flex_auth_url. Unset or unreachable fetch evaluator fails closed with a
message naming it; no fallback to the signing pin or to allow. warden access
advisory output names the fetch evaluator. Recorded under WARDEN-WP-0039-T03.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3

src/warden/cli.py

@@ -1551,6 +1551,8 @@ def access(
         )
     if expanded.policy_ref:
         console.print(f"  policy   : {expanded.policy_ref}   [dim]({gate})[/dim]")
+    elif entry.exec_capable:
+        console.print(f"  gate     : [dim]{gate}[/dim]")
     console.print(f"  wiki     : {entry.wiki_ref}")
     console.print(f"  canon    : {entry.canon_ref}")