Implement §5.3 machine-readably — layer.yaml, checker, conformance tests

The security layer model moved v0.1 -> v0.4 (accepted) after ops-warden's
assent. Both §5 asks from ADR-0010 were adopted: §5.2 now sanctions the conduit
shape on the supplied-authority property, and §5.3 is the declared engine gap
amendment, carrying the four fields verbatim and crediting ops-warden's
delegation machinery as prior art.

Which creates an obligation. §5.3 requires those fields MACHINE-READABLY, and
§11 makes "every direct Tooling client maps to a declared §5.1/§5.2/§5.3 entry"
a mechanical check. ops-warden's declaration was prose in INTENT.md — the repo
that proposed the shape was not implementing it.

layer.yaml is the map: 5 contacts (2 declared gaps, 1 read-only observation,
2 conduits) plus the non-Tooling clients recorded explicitly so the check is
total rather than silently selective.

scripts/check_layer_conformance.py enforces it and found three undeclared
modules on its first run — all false positives (help text, a docstring, and the
doubles library that SIMULATES bao rather than calling it), which is why the
scan now matches invocation shapes instead of the word: an httpx call built
against the configured OpenBao address, or an argv whose first element is the
bao binary.

tests/test_layer_conformance.py adds the §5.2 test the standard says SHOULD
exist: _caller_env() returns the caller's environment unchanged, and proxy.py
is asserted not to reference X-Vault-Token, approle login, or token create — a
conduit that presents its own token is not a conduit.

No assertion on review dates, deliberately: a date-triggered failure breaks the
build on a calendar day with no code change, the same reasoning WP-0033-T05
recorded for blocker staleness.

398 tests pass, ruff clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YWBMovyFoy9RRrfL7zKvPJ

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4014535@bnt-lap001
Assistant-Session: d0036016-73e8-4da1-8e47-563e3ab39a3c

INTENT.md

@@ -3,8 +3,9 @@
 > **Layer: Staff.** ops-warden is a Staff repository under the NetKingdom
 > IT-security layer model (Taxonomy -> Tooling -> Engines -> Staff, layered by
 > determinism and by the kind of artifact each layer produces):
-> `net-kingdom/canon/standards/security-layer-model_v0.1.md`, owned by gate-house,
-> ratified as `gate-house/decisions/decisions.md` GH-DEC-2026-001.
+> `net-kingdom/canon/standards/security-layer-model_v0.4.md` (**accepted**), owned by
+> gate-house, ratified as `gate-house/decisions/decisions.md` GH-DEC-2026-001.
+> ops-warden's assent is recorded there as `ADR-0010`.
 >
 > **The binding rule: Staff never touches Tooling directly. It acts only through
 > Engine APIs.** ops-warden holds no state another layer depends on at runtime and
@@ -19,8 +20,15 @@
 > runs the owner's tool under **the caller's** identity and supplies no authority of
 > its own (`ADR-0002`).
 >
-> Assent, reasoning, and the amendment offered back to gate-house:
-> `history/2026-08-28-security-layer-model-assent.md` and `ADR-0010`.
+> **The declaration is `layer.yaml`, not this note.** v0.4 §5.3 requires a gap to
+> carry `capability`, `intended_owner`, `blocked_on` and `review` *machine-readably*,
+> and §11 makes "every direct Tooling client maps to a declared §5.1/§5.2/§5.3 entry"
+> a mechanical check. `layer.yaml` is that map; `scripts/check_layer_conformance.py`
+> and `tests/test_layer_conformance.py` enforce it, so a new undeclared OpenBao
+> client fails on the commit that introduces it.
+>
+> Assent, reasoning, and the amendment offered back to gate-house — adopted as
+> v0.4 §5.3: `history/2026-08-28-security-layer-model-assent.md` and `ADR-0010`.
 
 > This file captures **why this repository exists**, the **direction it is
 > moving toward**, and the **kind of system it is meant to become**.