Add named engine auth and accessor-file session revoke

Select service-jwt, bootstrap, or env exclusively: JWT login uses a JSON
file, self-revokes, and never falls back to bootstrap or BAO_TOKEN. The
platform JWT mount/role is still unpublished, so auto keeps named
bootstrap/env providers.

session revoke --accessor-file revokes an already-issued token with
fingerprint-only evidence. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

evidence-classification.yaml

@@ -45,7 +45,7 @@ rules:
 
   - id: production-control-mutation
     kind: load-bearing
-    actions: [revoke, lifecycle-suspend, lifecycle-deactivate, provision]
+    actions: [revoke, lifecycle-suspend, lifecycle-deactivate, provision, session-revoke]
     stages: [prod]
     emission: local-outbox
     note: >-