Implement WP-0022 audit trail and WP-0023 INTENT–SCOPE closeout

Add unified metadata-only audit.jsonl with secret-material guard, instrument
sign/access/worker paths, and expose warden activity CLI. Surface broker hint
when VAULT_TOKEN is unset, refresh INTENT/SCOPE docs, and add production
integration checklists plus catalog lane promotion playbook.

src/warden/ca.py

@@ -61,6 +61,24 @@ def _append_signature_log(
     state_dir.mkdir(parents=True, exist_ok=True)
     with (state_dir / "signatures.log").open("a") as f:
         f.write(json.dumps(entry) + "\n")
+    try:
+        from warden.audit import record_event
+
+        record_event(
+            state_dir,
+            kind="sign",
+            action="issue",
+            subject=spec.actor_name,
+            target=spec.actor_name,
+            decision_id=spec.policy_decision_id,
+            outcome="ok",
+            source="sign",
+            actor_type=spec.actor_type.value,
+            backend=backend,
+            ttl_hours=spec.ttl_hours,
+        )
+    except Exception:
+        pass  # audit must not block signing
 
 
 def parse_cert_metadata(cert_path: Path) -> dict: