WARDEN-WP-0026 T03: masking display filter (defense-in-depth)

- warden/mask.py: fingerprint()/mask_value() — presence, length, 8-char sha256
  prefix; never the value.
- proxy.proxy_fetch_fingerprint + `warden access --fingerprint`: masked status view
  (presence/length/hash) that emits no value, so it bypasses the T02 stdout guard.
  Lets two parties compare sha256 prefixes to confirm a shared value without seeing
  it (e.g. rotation landed).
- documented as defense-in-depth (raw bao bypasses it) in OperatorAccessAssist.md
  and the module docstring.
- tests: tests/test_mask.py + CLI fingerprint test. 299 pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_proxy.py

@@ -364,3 +364,22 @@ def test_access_fetch_to_nonterminal_stdout_is_refused(tmp_path, monkeypatch):
     r = runner.invoke(app, ["access", "whynot-design-npm-publish", "--fetch", "--no-policy"])
     assert r.exit_code == 6
     assert "sanctioned transport" in r.output.lower() or "refusing" in r.output.lower()
+
+
+def test_access_fingerprint_masks_and_bypasses_stdout_guard(monkeypatch, tmp_path):
+    """--fingerprint prints a masked fingerprint (never the value) even to captured stdout."""
+    _proxy_env(monkeypatch, tmp_path)
+    monkeypatch.setenv("VAULT_TOKEN", "caller-token")
+
+    class _Fake:
+        returncode = 0
+        stdout = "top-secret-token-value"
+
+    monkeypatch.setattr("warden.proxy.subprocess.run", lambda *a, **k: _Fake())
+    r = runner.invoke(
+        app,
+        ["access", "whynot-design-npm-publish", "--fingerprint", "--no-policy"],
+    )
+    assert r.exit_code == 0
+    assert "top-secret-token-value" not in r.output   # value never shown
+    assert "hidden" in r.output and "sha256:" in r.output