Implement GH-DEC-2026-003 consume-before-OpenBao PEP gate

Every live privileged production handler CAS-consumes through
approval-engine before OpenBao. Conflict, unavailability, or a missing
binding fail closed. Live production remains disabled until the durable
decision record is served.

Record kings-guard assent on the secret-use evidence contract.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

README.md

@@ -63,6 +63,7 @@ SECRETS_ENGINE_HUB_URL="" bash scripts/demo-e2e.sh
 - Hardening backlog (exit bootstrap mode): [docs/hardening-backlog.md](docs/hardening-backlog.md)
 - Existing-lane catalog admission: [docs/catalog-admission.md](docs/catalog-admission.md)
 - KeyCape service-auth consumer boundary: [docs/service-auth.md](docs/service-auth.md)
+- Approval consume-before-OpenBao (GH-DEC-2026-003): [docs/approval-consumption.md](docs/approval-consumption.md)
 
 The implementation is a Python package (`src/secrets_engine/`). OpenBao is
 reached only through the `bao` CLI adapter (`openbao.py`); the rest of the code
@@ -77,5 +78,8 @@ speaks in lanes and guarded plans.
 - Production live actions fail closed until the durable State Hub
   action-authorization endpoint is available; local approval mirrors are
   throwaway-demo material only.
+- A privileged production OpenBao call also requires a successful
+  approval-engine CAS consume first. Conflict or unavailability means do
+  not write.
 - Temporary bootstrap OpenBao credentials must live outside repos, use mode
   0600, be revocable, and be removed after narrower auth is working.