WARDEN-WP-0026 T03: masking display filter (defense-in-depth)

- warden/mask.py: fingerprint()/mask_value() — presence, length, 8-char sha256
  prefix; never the value.
- proxy.proxy_fetch_fingerprint + `warden access --fingerprint`: masked status view
  (presence/length/hash) that emits no value, so it bypasses the T02 stdout guard.
  Lets two parties compare sha256 prefixes to confirm a shared value without seeing
  it (e.g. rotation landed).
- documented as defense-in-depth (raw bao bypasses it) in OperatorAccessAssist.md
  and the module docstring.
- tests: tests/test_mask.py + CLI fingerprint test. 299 pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md

@@ -115,11 +115,20 @@ the anti-pattern is documented fleet-wide.
 
 ```task
 id: WARDEN-WP-0026-T03
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "21ab08d5-7782-4567-a08d-980211dd7851"
 ```
 
+Done 2026-07-16: `warden/mask.py` (`fingerprint`/`mask_value` — presence, length,
+8-char sha256 prefix; never the value) + `proxy_fetch_fingerprint` and a
+`warden access … --fingerprint` masked status view (bypasses the stdout guard
+because it emits no value). Lets two parties compare sha256 prefixes to confirm a
+shared value (e.g. rotation landed) without disclosure. Explicitly labelled
+defense-in-depth — raw `bao kv get` bypasses it — in `wiki/OperatorAccessAssist.md`
+and the module docstring. Tests in `tests/test_mask.py` + a CLI test in
+`tests/test_proxy.py`.
+
 In the warden wrapper, mask KV data values by default when any listing/status is
 shown — display presence, length, and a short non-reversible hash instead of the
 value. Explicitly labelled as defense-in-depth (raw bao bypasses it).