Implement WP-0022 audit trail and WP-0023 INTENT–SCOPE closeout

Add unified metadata-only audit.jsonl with secret-material guard, instrument
sign/access/worker paths, and expose warden activity CLI. Surface broker hint
when VAULT_TOKEN is unset, refresh INTENT/SCOPE docs, and add production
integration checklists plus catalog lane promotion playbook.

src/warden/vault_hints.py

@@ -0,0 +1,22 @@
+"""Operator hints for vault-backed signing without manual token paste."""
+
+from __future__ import annotations
+
+BROKER_CATALOG_ID = "ops-warden-warden-sign-token"
+
+BROKER_EXEC_TEMPLATE = (
+    "cd ~/railiance-platform && scripts/credential.py exec "
+    "--grant ops-warden/warden-sign --ttl 15m -- "
+    "warden sign <actor> --pubkey <path>"
+)
+
+
+def missing_vault_token_message(token_env: str) -> str:
+    """Structured hint when vault backend lacks a scoped token."""
+    return (
+        f"Vault token not found. Set {token_env!r} for the current shell only, "
+        f"or use the railiance-platform credential broker (preferred):\n"
+        f"  warden route show {BROKER_CATALOG_ID}\n"
+        f"  {BROKER_EXEC_TEMPLATE}\n"
+        f"See wiki/playbooks/ops-warden-warden-sign-token.md"
+    )