Add named engine auth and accessor-file session revoke

Select service-jwt, bootstrap, or env exclusively: JWT login uses a JSON
file, self-revokes, and never falls back to bootstrap or BAO_TOKEN. The
platform JWT mount/role is still unpublished, so auto keeps named
bootstrap/env providers.

session revoke --accessor-file revokes an already-issued token with
fingerprint-only evidence. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

layer.yaml

@@ -33,6 +33,7 @@ owned_tooling:
     operations:
       - "bao policy/auth/kv subprocess adapter"
       - "CAS-aware KV create/patch via JSON input files, never argv values"
+      - "JWT login via JSON input files; issued engine tokens self-revoke"
     note: >-
       This is the owned Lifecycle contact, not a Staff §5 shape. A new direct
       OpenBao client outside the listed modules is a finding.
@@ -56,6 +57,7 @@ protected_actions:
   - lifecycle-suspend
   - lifecycle-deactivate
   - lifecycle-destroy
+  - session-revoke
 
 # §13 proposed capabilities. Owner status is proposed, not assented, until
 # the surface exists in this repository's own contract.
@@ -143,12 +145,15 @@ non_tooling_clients:
     layer: tooling
     modules:
       - src/secrets_engine/service_auth.py
-    operation: "HTTPS client_credentials exchange; not connected to OpenBao"
+      - src/secrets_engine/engine_auth.py
+    operation: "HTTPS client_credentials exchange; OpenBao JWT login when the platform contract is present"
     write: false
     note: >-
-      key-cape is catalogued Tooling. This contact is an identity-token
-      preflight only and is deliberately not a write into OpenBao. Wiring it
-      as OpenBao JWT login remains blocked on the platform-owned role.
+      key-cape is catalogued Tooling. The consumer exchanges a service JWT and
+      logs in only when SECRETS_ENGINE_OPENBAO_JWT_LOGIN names a published
+      mount/role contract. Failure never falls back to bootstrap or BAO_TOKEN.
+      The platform-owned role remains unpublished, so auto still uses the
+      named bootstrap/env providers.
 
   - id: audit-core-outbox-drain
     target: audit-core