SCOPE/docs: WARDEN-WP-0045 per-actor limits; OpenBao via bridge tunnel; editable install

Record the per-actor extension allow-list and max_ttl_hours ceiling with the
agt-custodian profile. Point production examples at the ops-bridge OpenBao
tunnel (127.0.0.1:18200) now that bao.coulomb.social is no longer public, and
document the editable install.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61

examples/warden.production.example.yaml

@@ -4,7 +4,9 @@
 backend: vault
 
 vault:
-  addr: https://bao.coulomb.social
+  # OpenBao via the ops-bridge tunnel (railiance01). bao.coulomb.social is no
+  # longer public; it serves a notice, not the API.
+  addr: http://127.0.0.1:18200
   mount: ssh
   role_map:
     adm: adm-role