Revise KeyCape secrets-engine-openbao custody: OpenBao-only, operator reader CCR-2026-0034 (source only)

Founder direction 2026-10-06 and ops-mason plan keycape-secrets-engine-openbao-client-custody
(658cdbc, MASON-WP-0009): the client secret lives only in OpenBao.

- CCR-2026-0033: consumer file and secrets-engine D1-D4 removed; KV metadata declared
  (cas_required, max_versions=2, delete_version_after=0s, custom_metadata); target.domain
  infotech; live order and roll-forward rollback revised; status stays proposed.
- New sibling CCR-2026-0034 + policy: attended OIDC operator reader on auth/netkingdom,
  read data path + revoke-self only, 5m/4 uses, no default policy, bound
  groups=net-kingdom-admins and /assurance/level=aal2 (KeyCape 7d96ee4). Proposed,
  bound claims unconfirmed (founder item for both readers).
- credential-change.py: OIDC roles carry token_max_ttl/explicit_max_ttl/no_default_policy/
  num_uses/type and bound_claims_type (string only); token_revoke_self policy option;
  validated openbao.kv_metadata. Tests added.
- Custody child: consumer write and check-secret-file removed; cas=0 create / --rotate
  cas=<current>; compare-before-write metadata put; refusals unchanged.
- Founder runbook (keycape/founder-runbook.md), window docs, RPF-WP-0035-T09 (waits on A1/A2/A3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b

workplans/RPF-WP-0035-credential-lane-implementation.md

@@ -769,14 +769,19 @@ id: RPF-WP-0035-T09
 status: wait
 needs_human: true
 priority: high
-depends_on: [SECRETS-WP-0012-T02]
-blocking_reason: "Founder must approve proposed CCR-2026-0033 (platform-owner, key-cape-owner, net-kingdom-owner reviews; bound claims confirmed) and the exact attended custody child run with a decision id recorded in the CCR review. Boundary decision 632a8893 does not cover generation, write or delivery. secrets-engine D1-D4 resolve first."
+depends_on: []
+blocking_reason: "Waits for founder approvals: A1 ops-mason design (keycape-secrets-engine-openbao-client-custody, MASON-WP-0009); A2 revised CCR-2026-0033 plus sibling operator reader CCR-2026-0034 (platform-owner, key-cape-owner, net-kingdom-owner reviews; bound claims confirmed for both readers incl. groups=net-kingdom-admins and /assurance/level=aal2); A3 the exact custody-child decision id recorded in the CCR-2026-0033 review (not boundary decision 632a8893). secrets-engine D1-D4 are superseded (no consumer copy)."
+state_hub_task_id: "7c753be6-42f1-58a6-a4a4-a7ed686f461f"
 ```
 
-Packet: `credential-change-requests/CCR-2026-0033.yaml` (custody_child,
-consumer_copy, live_order, rollback). Run after approval, attended:
-`python3 scripts/keycape_secrets_engine_openbao_custody.py provision
---approval-decision <id> --receipt <new path>` inside the warden platform-admin
-envelope. Later live steps (ESO, NetKingdom patch, registration, restart,
-KEY-WP-0037-T04 issuance, T02 JWT login proof) each need their own go.
+Packets: `credential-change-requests/CCR-2026-0033.yaml` (custody child, KV
+metadata, issuer ESO reader, live_order, rollback) and `CCR-2026-0034.yaml`
+(attended operator OIDC reader, in-memory, 5m/4 uses). Revised 2026-10-06 per
+founder direction; the consumer file is removed. Exact founder commands:
+`docs/provisioning-windows/2026-10-04-1000/keycape/founder-runbook.md`. Live
+order: custody child → platform applies policies/roles/ESO (Secret
+sso/keycape-secrets-engine-openbao-client exists) → NetKingdom env patch
+(NK-WP-0046) → KeyCape registration merge (KEY-WP-0037-T03) → KeyCape restart
+immediately → live issuance check (KEY-WP-0037-T04) → OpenBao JWT role/login
+proof (RPF-WP-0035-T02). Each live step after the custody run needs its own go.