Harden secret provisioning and lifecycle controls

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

policies/secrets-engine-build.hcl

@@ -6,7 +6,7 @@
 
 # KV v2 data + metadata under the build prefix.
 path "secret/data/build/*" {
-  capabilities = ["create", "read", "update", "delete"]
+  capabilities = ["create", "read", "update", "patch", "delete"]
 }
 path "secret/metadata/build/*" {
   capabilities = ["create", "read", "update", "delete", "list"]

policies/secrets-engine-prod.hcl

@@ -15,7 +15,7 @@
 # Apply approved production lane values (provisioning) and metadata.
 # Owner-scoped prod lanes (e.g. whynot-design/...) — NOT under build/ or test/.
 path "secret/data/+/*" {
-  capabilities = ["create", "update"]
+  capabilities = ["create", "update", "patch"]
 }
 path "secret/metadata/+/*" {
   capabilities = ["create", "read", "update", "list"]

policies/secrets-engine-test.hcl

@@ -5,7 +5,7 @@
 # cannot administer sys/, auth/, or identity/, cannot act as root.
 
 path "secret/data/test/*" {
-  capabilities = ["create", "read", "update", "delete"]
+  capabilities = ["create", "read", "update", "patch", "delete"]
 }
 path "secret/metadata/test/*" {
   capabilities = ["create", "read", "update", "delete", "list"]