CUST-WP-0075: tenant-engine sender seed helper; re-qualify RPF-WP-0035-T02/T08

- scripts/tenant_engine_audit_core_sender_seed.py: silent attended row-7 seed
  for MASON-WP-0007-T05 (wrap-migrate technique, CAS 0, never overwrites,
  metadata-only --dry-run, documented exit codes), with offline fake-bao tests.
- Lane review doc with the exact founder sequence and the read-only ESO
  token-create can-i check for MASON-WP-0007-T06.
- RPF-WP-0035-T02: SECRETS-WP-0007-T04 is done; real blocker is live KeyCape
  registration and client custody of secrets-engine-openbao (blocked_on
  key-cape). Design stays proposed.
- RPF-WP-0035-T08: receiver rollout with evidence_kind already accepted
  2026-09-11; moved the misplaced D1 correction note here from T02.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3

intakes/intakes.md

@@ -48,6 +48,9 @@ description: >-
   audience openbao, 15m ttl/max/explicit max, no default policy). Not applied.
   Open: attended apply, then the founder-attended KV seed (plan row 7).
   No RBAC change needed here (see message).
+  2026-10-03 (CUST-WP-0075): row-7 seed helper scripts/tenant_engine_audit_core_sender_seed.py
+  (silent, CAS 0, never overwrites, metadata-only --dry-run) and lane review
+  docs/credential-lane-designs/tenant-engine-audit-core-sender-seed.md added; not run.
 state_hub_intake_id: "01a0fedd-7af5-7126-a263-647d438b068d"
 ```