Add named engine auth and accessor-file session revoke

Select service-jwt, bootstrap, or env exclusively: JWT login uses a JSON
file, self-revokes, and never falls back to bootstrap or BAO_TOKEN. The
platform JWT mount/role is still unpublished, so auto keeps named
bootstrap/env providers.

session revoke --accessor-file revokes an already-issued token with
fingerprint-only evidence. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

src/secrets_engine/evidence_class.py

@@ -43,6 +43,7 @@ SHIPPED_RULES = (
             "lifecycle-suspend",
             "lifecycle-deactivate",
             "provision",
+            "session-revoke",
         ),
         "stages": ("prod",),
     },