Implement SECRETS-WP-0008 unblocked layer-model obligations

Load pep-stance.yaml as the live unreachable-engine gate and record named
stance fields on privileged evidence. Classify evidence, queue load-bearing
records in a local outbox, and add heartbeat/drain commands that never sit
on a mutation path. Publish proposed SSH-CA and secret-use evidence
contracts without adding an OpenBao SSH-CA write.

T02 (access-engine decision records) and T06 (no standing credential) stay
wait on external endpoints.

Assistant: grok
Assistant-Session: 01a04cea-cb33-7c63-bad7-c1b0f9f0076b

pep-stance.yaml

@@ -11,10 +11,9 @@
 # Catalog stage is the equivalent scope until security-zone membership arrives
 # as a claim on the decision.
 #
-# The property that makes this worth reading: tests/test_layer_conformance.py
-# asserts this map against the shipped production fail-closed gate in
-# secrets_engine.cli._require_lane_approval. A published map free to drift
-# from the code is worse than none.
+# Runtime reads this file. tests/test_layer_conformance.py also pins
+# secrets_engine.pep_stance.SHIPPED_STANCE to this map. A published map free
+# to drift from that pin is worse than none.
 
 schema_version: "0.1"
 framework: netkingdom-security-layer-model
@@ -58,20 +57,17 @@ demo_exception:
 
 on_apply:
   recorded_fields:
-    - stage
-    - action
+    - stance_stage
+    - stance_failure_mode
+    - stance_demo_exception
+    - stance_decision_id       # present only where a decision was resolved
     - approval_status          # rejected when the stance refuses
     - error_type               # DecisionError when fail_closed fires
-    - decision_id              # present only where a decision was resolved
   written_to:
     - "local JSONL (.evidence/evidence-YYYY-MM-DD.jsonl)"
-    - "best-effort State Hub progress note"
+    - "evidence_dir/outbox/ for load-bearing classes"
+    - "best-effort State Hub progress note (attributive only)"
   never_recorded: "any secret material, token, password, or raw value"
-  gap: >-
-    Stance application is currently recorded as a DecisionError on the
-    privileged-evidence path, not as named stance fields (stage, failure
-    mode, decision id present only where rendered). Closing that gap is
-    SECRETS-WP-0008-T01.
 
 # §6.4 obligation 2 — the verdict is never cached. A retry of the same
 # canonical request digest inside the decision lifetime is the decision