Implement GH-DEC-2026-003 consume-before-OpenBao PEP gate

Every live privileged production handler CAS-consumes through
approval-engine before OpenBao. Conflict, unavailability, or a missing
binding fail closed. Live production remains disabled until the durable
decision record is served.

Record kings-guard assent on the secret-use evidence contract.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

src/secrets_engine/evidence.py

@@ -237,6 +237,7 @@ class PrivilegedActionEvidence:
     approval_status: str = "pending"
     completed: bool = False
     stance: dict[str, Any] = field(default_factory=dict)
+    consume: dict[str, Any] = field(default_factory=dict)
 
     def __post_init__(self) -> None:
         if not self.approval_required:
@@ -252,6 +253,8 @@ class PrivilegedActionEvidence:
         )
         if self.stance:
             merged.update(self.stance)
+        if self.consume:
+            merged.update(self.consume)
         if extra:
             merged.update(extra)
         return merged
@@ -273,6 +276,17 @@ class PrivilegedActionEvidence:
         self.decision_id = str(getattr(decision, "id", ""))
         self.approval_status = "approved"
 
+    def mark_consumed(self, consumed: object | None) -> None:
+        if consumed is None:
+            return
+        if hasattr(consumed, "as_evidence"):
+            payload = consumed.as_evidence()
+        elif isinstance(consumed, dict):
+            payload = consumed
+        else:
+            return
+        self.consume = {key: value for key, value in payload.items() if value != ""}
+
     def mark_stance(self, stance: object | None) -> None:
         if stance is None:
             return