Read bootstrap creds from OpenBao only. Write non-secret attributes after create. Never print keys.
Identity, topology, consumer bindings, and the planned attribute file (region nl-ams, endpoint/bucket still null). Post-purchase fill is REEF-STORAGE-WP-0002.