WARDEN-WP-0026 finish Strand A (T04/T05/T07)

Promote railiance-backup-offsite-lane to active/resolvable after
capabilities-safe re-verify. Add catalog risk=high, agent read-boundary
(exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and
close WP-0026.

tests/test_taint.py

@@ -0,0 +1,70 @@
+"""Tests for EXPOSED taint convention (WARDEN-WP-0026 T05)."""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import pytest
+from typer.testing import CliRunner
+
+from warden.cli import app
+from warden.taint import (
+    EXPOSED_AT,
+    TaintStatus,
+    parse_custom_metadata,
+    kv_metadata_path,
+)
+
+runner = CliRunner()
+
+
+def test_parse_custom_metadata_tainted():
+    status = parse_custom_metadata({
+        "custom_metadata": {
+            EXPOSED_AT: "2026-07-16T00:00:00Z",
+            "exposed_version": "2",
+            "exposed_reason": "test",
+            "exposed_ref": "history/x.md",
+        },
+        "current_version": 2,
+    })
+    assert status.tainted is True
+    assert status.exposed_at == "2026-07-16T00:00:00Z"
+    assert status.exposed_version == "2"
+    assert status.current_version == 2
+
+
+def test_parse_custom_metadata_clean():
+    status = parse_custom_metadata({"custom_metadata": None, "current_version": 1})
+    assert status.tainted is False
+    assert status.exposed_at is None
+
+
+def test_parse_empty_exposed_at_not_tainted():
+    status = parse_custom_metadata({"custom_metadata": {EXPOSED_AT: "  "}, "current_version": 1})
+    assert status.tainted is False
+
+
+def test_kv_metadata_path_strips():
+    assert kv_metadata_path("  platform/workloads/x  ") == "platform/workloads/x"
+
+
+def test_taint_status_to_dict():
+    s = TaintStatus(
+        lane_id="x", path="p", tainted=True,
+        exposed_at="t", exposed_version="1", current_version=1,
+    )
+    d = s.to_dict()
+    assert d["tainted"] is True
+    assert d["id"] == "x"
+
+
+def test_taint_cli_unknown_id():
+    result = runner.invoke(app, ["taint", "no-such-lane-xyz"])
+    assert result.exit_code == 1
+
+
+def test_taint_cli_template_lane_errors():
+    """openbao-api-key has <placeholders> — cannot query taint."""
+    result = runner.invoke(app, ["taint", "openbao-api-key", "--json"])
+    assert result.exit_code == 2