feat(policy): netkingdom maturity-gated publication-scope policy

Token scope is now bound to package maturity, gated on netkingdom's own maturity:
- maturity-build -> gitea-wide, maturity-test -> org-wide, maturity-prod -> repo-scoped
  (scope narrows as stakes rise; broad tokens only for low-stakes build artifacts)
- the graduated table is DORMANT until netkingdom reaches production grade; until
  then every lane clamps to repo-scope, injected as NPM_AUTH_TOKEN (fail-safe)
- token env-var name signals blast radius: NPM_AUTH_TOKEN (repo default),
  NPM_AUTH_COULOMB_TOKEN (org), NPM_AUTH_GITEA_TOKEN (gitea), NPM_AUTH_WHYNOT_TOKEN
  (npm scope, defined but unused), NPM_AUTH_WHYNOTDESIGN (explicit repo)

netkingdom is at maturity-build today, so whynot-design resolves to repo-scope /
NPM_AUTH_TOKEN. Flip netkingdom_maturity to maturity-prod to activate graduation.

- policies/netkingdom-publication-scope.yaml: the policy data + gate
- publication_policy.py: load + resolve (clamp/active, env naming, override)
- exec delivery injects under the resolved env-var name (was fixed SE_NPM_TOKEN)
- catalog lane carries delivery_config.npm.maturity
- new CLI: `secrets-engine policy publication <lane>`
- docs/publication-scope-policy.md; tests for clamp, graduation, naming, override

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/secrets_engine/cli.py

@@ -211,6 +211,27 @@ def cmd_exec(cfg: Config, args) -> int:
     return rc
 
 
+def cmd_policy_publication(cfg: Config, args) -> int:
+    from secrets_engine.publication_policy import PublicationPolicy, resolve
+    entry = get_entry(cfg.catalog_dir, args.catalog_id)
+    npm = entry.npm
+    if not npm:
+        from secrets_engine.errors import PolicyGuardError
+        raise PolicyGuardError(f"lane '{entry.id}' has no npm delivery config")
+    policy = PublicationPolicy.load(cfg.policy_dir)
+    res = resolve(
+        policy,
+        org=entry.org, repo=entry.repo, npm_scope=npm.get("scope", ""),
+        package_maturity=npm.get("maturity", "maturity-build"),
+        token_env_override=npm.get("token_env", ""),
+    )
+    print(f"lane: {entry.id}  ({entry.owner})")
+    print(f"netkingdom maturity: {policy.netkingdom_maturity}  "
+          f"(production_grade={policy.production_grade})")
+    print(res.render())
+    return 0
+
+
 def cmd_route(cfg: Config, args) -> int:
     entry = get_entry(cfg.catalog_dir, args.catalog_id)
     client = OpenBaoClient.resolve(cfg.bao_addr)
@@ -306,6 +327,12 @@ def build_parser() -> argparse.ArgumentParser:
                     help="command after '--'")
     ex.set_defaults(func=cmd_exec)
 
+    po = sub.add_parser("policy", help="inspect secrets-engine policies")
+    posub = po.add_subparsers(dest="subcmd", required=True)
+    popub = posub.add_parser("publication", help="resolve a lane's publication scope + token env")
+    popub.add_argument("catalog_id")
+    popub.set_defaults(func=cmd_policy_publication)
+
     ro = sub.add_parser("route", help="ops-warden routing pointer for a lane")
     ro.add_argument("catalog_id")
     ro.add_argument("--json", action="store_true")