RPF-WP-0054-T03: credential.py generate for keycape-client-secret-generate

Silent generate-in-custody: verifies the SecurityCase file (digest, type,
materialized, confidential, client_id) per ops-warden 23985370, mints the 5m
create-only grant token from the caller's session, proves absence, writes once
with CAS 0, verifies by metadata only and revokes the token. Agents, root and
callers without the issuer policy are refused. Secret length awaits key-cape.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9

scripts/credential.py

@@ -1177,6 +1177,12 @@ def build_parser() -> argparse.ArgumentParser:
 
 def main() -> int:
     guard_verbose_env()
+    if sys.argv[1:2] == ["generate"]:
+        # RPF-WP-0054: generate-in-custody runs on the caller's own session and
+        # must stay silent, so it bypasses the lease runner and issuer prompt.
+        sys.path.insert(0, str(Path(__file__).resolve().parent))
+        from keycape_client_secret_generate import main as generate_main
+        return generate_main(sys.argv[2:])
     parser = build_parser()
     args = parser.parse_args()
     args.lease_dir = resolve_repo_path(args.lease_dir)