WARDEN-WP-0026 finish Strand A (T04/T05/T07)

Promote railiance-backup-offsite-lane to active/resolvable after
capabilities-safe re-verify. Add catalog risk=high, agent read-boundary
(exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and
close WP-0026.

.claude/rules/credential-routing.md

@@ -56,6 +56,20 @@ stdout unless you pass `--unsafe-stdout` (interactive human sessions only):
 | **Env (exec)** | `warden access <need> --exec -- <cmd>` | value injected into the child process env only |
 | **Wrapping token** | `warden access <need> --wrap` | a single-use, short-TTL OpenBao wrapping token to `bao unwrap` in your own context |
 
+### Agent read-boundary on high-risk lanes (WP-0026 T04)
+
+When `WARDEN_AGENT_ID` is set and the catalog lane is `risk: high`, raw value
+streaming is refused (exit 7). Use `--out` / `--exec` / `--wrap` / `--fingerprint`
+only. OpenBao policy `agent-high-risk-boundary` denies data-read on those paths
+for agent tokens (metadata/capabilities only). See
+`wiki/playbooks/agent-read-boundary.md`.
+
+### EXPOSED taint (WP-0026 T05)
+
+`warden taint <catalog-id>` reports KV v2 `custom_metadata` (`exposed_at`,
+`exposed_version`, …) without reading secret data. Convention:
+`wiki/playbooks/exposed-taint.md`.
+
 ### Other capabilities (reuse-surface)
 
 Non-credential capabilities are usually discovered through **reuse-surface** federation