WARDEN-WP-0026 finish Strand A (T04/T05/T07)

Promote railiance-backup-offsite-lane to active/resolvable after
capabilities-safe re-verify. Add catalog risk=high, agent read-boundary
(exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and
close WP-0026.

AGENTS.md

@@ -148,6 +148,15 @@ Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run wa
 - `POST /messages/` to `ops-warden` asking for `ISSUE_CORE_API_KEY`, `OPENROUTER_API_KEY`, etc.
 - Inventing `warden secret`, `warden login`, `warden bao`, `warden tunnel` — they do not exist
 - Pasting secrets into Git, State Hub, workplans, logs, or chat
+- **Reading a secret value onto a captured stdout.** Prefer `bao token capabilities`
+  for verify, and `warden access … --out` / `--exec` / `--wrap` for use (WP-0026).
+
+### Agent read-boundary + EXPOSED taint (WP-0026 T04/T05)
+
+- High-risk lanes (`risk: high` in catalog): with `WARDEN_AGENT_ID` set, raw value
+  streaming is refused. Use sanctioned transports only.
+- `warden taint <id>` reports EXPOSED metadata without reading secret data.
+- Playbooks: `wiki/playbooks/agent-read-boundary.md`, `wiki/playbooks/exposed-taint.md`.
 
 ### Other capabilities (reuse-surface)