RPF-WP-0054-T02: founder chooses templated create-only grant (option A)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9

workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md

@@ -65,9 +65,8 @@ format, field or caller.
 
 ```task
 id: RPF-WP-0054-T02
-status: todo
+status: done
 priority: high
-needs_human: true
 state_hub_task_id: "4183abc4-4acc-5937-9f27-005feb181025"
 ```
 
@@ -95,6 +94,11 @@ plus the case-reference check make it visible.
 **Done when:** the founder records the choice here (and on a State Hub decision
 if one is opened).
 
+**Decision 2026-10-09 (founder): option A**, one templated create-only grant
+`keycape/client-secret-generate` with the broker-side case-ref and
+absence checks above. T04 implements it; per-case exact grants (B) are not
+built.
+
 ## T03 — Implement the broker generate operation
 
 ```task