Park the warden-sign AppRole with explicit un-park triggers

Founder decision 2026-08-11: neither withdraw nor proceed. The broker covers
the workstation, but unattended signing on a remote tunnel host is unresolved,
and there the AppRole is narrower than placing the broker's issuer token.

Recorded where each trigger will be hit: WP-0027 break-glass task (trust-root
design), and the ops-bridge cutover playbook (token source must be resolved
before going live). secrets-engine told to stop holding apply readiness.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

wiki/playbooks/ops-bridge-tunnel-cert.md

@@ -65,6 +65,16 @@ warden sign agt-state-hub-bridge --pubkey ~/.ssh/agt-state-hub-bridge_ed25519.pu
 
 Confirm exit 0 and cert line starts with `ssh-ed25519-cert-v01@openssh.com`.
 
+> **Attended only.** The manual `export` above is the documented fallback
+> (`wiki/playbooks/operator-openbao-token-hygiene.md`); prefer the credential broker
+> (`ops-warden-warden-sign-token`). Neither answers **unattended renewal on the remote
+> tunnel host**, which is an open question, not an oversight: running the broker there
+> requires placing the railiance-platform checkout and its *issuer* token on that host.
+> A narrower alternative — a `warden-sign` AppRole scoped to `ssh/sign/{agt,adm,atm}-role`
+> — is validated but **parked** (`workplans/ADHOC-2026-08-11.md` T03, secrets-engine
+> `SECRETS-WP-0004`). **Resolve the token source before the live cutover**; do not
+> default to a long-lived exported token on the tunnel host.
+
 ---
 
 ## Migration checklist