Add named engine auth and accessor-file session revoke

Select service-jwt, bootstrap, or env exclusively: JWT login uses a JSON
file, self-revokes, and never falls back to bootstrap or BAO_TOKEN. The
platform JWT mount/role is still unpublished, so auto keeps named
bootstrap/env providers.

session revoke --accessor-file revokes an already-issued token with
fingerprint-only evidence. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

workplans/SECRETS-WP-0007-production-lifecycle-hardening.md

@@ -168,8 +168,8 @@ destroy stays fail-closed until T04's exact-action contract; that is the
 designed containment, not unfinished T03 work. Issued delivery sessions
 self-revoke in T05.
 
-Residual, not this task: a general known-accessor operator command. Tracked in
-`docs/hardening-backlog.md` H4a.
+Residual from this task, now implemented: `secrets-engine session revoke
+--accessor-file` (hardening H4a). Lease-id revoke remains outstanding.
 
 Progress 2026-08-23. Added one lifecycle plan model shared by dry-run and live
 execution. Ordinary `revoke` safely aliases native deactivation; suspend and
@@ -177,8 +177,8 @@ deactivate preserve KV custody and externally managed workload delivery.
 Destroy has an unmistakable dry-run plan and exact-id confirmation, but its live
 handler is deliberately fail-closed before coarse lane approval or backend
 access until T04 supplies distinct action authorization. Scoped issued-session
-self-revocation is implemented in T05; a general known-accessor operator command
-remains outstanding.
+self-revocation is implemented in T05; a general known-accessor operator
+command is `session revoke --accessor-file` (H4a).
 
 Replace the overloaded `revoke` behavior with explicit lifecycle operations and
 plans. Define at least: