feat(policy): netkingdom maturity-gated publication-scope policy

Token scope is now bound to package maturity, gated on netkingdom's own maturity:
- maturity-build -> gitea-wide, maturity-test -> org-wide, maturity-prod -> repo-scoped
  (scope narrows as stakes rise; broad tokens only for low-stakes build artifacts)
- the graduated table is DORMANT until netkingdom reaches production grade; until
  then every lane clamps to repo-scope, injected as NPM_AUTH_TOKEN (fail-safe)
- token env-var name signals blast radius: NPM_AUTH_TOKEN (repo default),
  NPM_AUTH_COULOMB_TOKEN (org), NPM_AUTH_GITEA_TOKEN (gitea), NPM_AUTH_WHYNOT_TOKEN
  (npm scope, defined but unused), NPM_AUTH_WHYNOTDESIGN (explicit repo)

netkingdom is at maturity-build today, so whynot-design resolves to repo-scope /
NPM_AUTH_TOKEN. Flip netkingdom_maturity to maturity-prod to activate graduation.

- policies/netkingdom-publication-scope.yaml: the policy data + gate
- publication_policy.py: load + resolve (clamp/active, env naming, override)
- exec delivery injects under the resolved env-var name (was fixed SE_NPM_TOKEN)
- catalog lane carries delivery_config.npm.maturity
- new CLI: `secrets-engine policy publication <lane>`
- docs/publication-scope-policy.md; tests for clamp, graduation, naming, override

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

catalog/whynot-design-npm-publish.yaml

@@ -44,6 +44,13 @@ delivery_config:
     registry: "https://gitea.coulomb.social/api/packages/coulomb/npm/"
     scope: "@whynot"
     package: "@whynot/design"
+    # Package maturity tag. Under the netkingdom publication-scope policy this
+    # would map to a publication scope (build->gitea, test->org, prod->repo) once
+    # netkingdom is production grade. netkingdom is at maturity-build today, so the
+    # policy is dormant and this lane clamps to repo-scope, injected as
+    # NPM_AUTH_TOKEN. Set `token_env` to override the resolved name.
+    maturity: maturity-build
+    # token_env: NPM_AUTH_WHYNOTDESIGN   # explicit per-repo form (optional)
 
 # Privileged actions on this lane require an approved decision/CCR.
 approval: