feat: add auth-capability lanes and pilot closeout

Add the warden-sign auth-capability lane, AppRole handoff, verification guards, docs, and tests.

Point the whynot-design pilot at the canonical decision and add the real publish closeout preflight/runbook.

.decisions/e6381a56-6b04-4fd5-b2de-f3ef59cde888.yaml

@@ -0,0 +1,16 @@
+# Offline fallback mirror for the canonical State Hub decision.
+#
+# Normal production use should resolve this UUID from State Hub with source: hub.
+# This file exists only so throwaway offline demos can run when
+# SECRETS_ENGINE_HUB_URL is empty or State Hub is unreachable. NON-SECRET:
+# contains no token value.
+id: e6381a56-6b04-4fd5-b2de-f3ef59cde888
+title: "Review CCR-2026-0001 corrected whynot-design npm publish token lane"
+status: resolved
+superseded_by: null
+decided_by: "human"
+review_url: "http://127.0.0.1:8000/decisions/e6381a56-6b04-4fd5-b2de-f3ef59cde888"
+rationale: >-
+  APPROVE: We fixed the path using coulomb as the org/tenant. Approval covers
+  establishing the whynot-design npm publish lane metadata; it does not expose or
+  store the package token value.

.decisions/whynot-design-npm-publish.yaml

@@ -1,15 +0,0 @@
-# Local approval fixture for the whynot-design npm publish lane.
-#
-# Stand-in for the canonical State Hub decision object, which does not yet exist
-# (see PRD open question). When a real decision is recorded in State Hub, set the
-# catalog's approval.decision_ref to that decision's UUID and this fixture becomes
-# unnecessary. NON-SECRET: contains no token value.
-id: whynot-design-npm-publish
-title: "Approve whynot-design npm publish lane (prod)"
-status: resolved          # resolved => approved for apply
-superseded_by: null
-decided_by: "Tegwick"
-review_url: ""
-rationale: >-
-  Pilot lane for secrets-engine MVP. Production npm automation token for
-  whynot-design, delivered exec-time only via temporary npm config.