feat: add auth-capability lanes and pilot closeout

Add the warden-sign auth-capability lane, AppRole handoff, verification guards, docs, and tests.

Point the whynot-design pilot at the canonical decision and add the real publish closeout preflight/runbook.

catalog/warden-sign.yaml

@@ -0,0 +1,86 @@
+# warden-sign auth-capability lane.
+# NON-SECRET: this file contains only OpenBao policy/AppRole metadata and
+# operational pointers. AppRole secret_id values and tokens must never appear in
+# Git, State Hub, chat, prompts, workplans, or normal logs.
+id: warden-sign
+kind: auth-capability
+org: netkingdom
+repo: ops-warden
+stage: prod
+description: >-
+  Scoped OpenBao AppRole used by ops-warden production smoke tests to call the
+  SSH secrets engine signing API over HTTP. This lane grants update only on the
+  exact SSH signing roles needed for FLEX-WP-0007 T4; it stores no KV value.
+
+# Existing production OpenBao SSH secrets-engine mount and logical operation.
+mount: ssh
+path: sign
+
+consumers:
+  - name: ops-warden-policy-smoke
+    auth: approle
+    claim: "agent:agt-state-hub-bridge"
+    purpose: >-
+      Run warden sign and the flex-auth policy-gate production smoke without
+      giving ops-warden standing custody of an OpenBao token.
+    allowed_actors:
+      - agt-state-hub-bridge
+      - agt-codex-interhub-bootstrap
+      - adm-example
+      - atm-backup-daily
+
+# The deliverable is a freshly minted AppRole secret_id plus role_id handed to
+# the operator out-of-band. There is no KV value and no from-file provisioning.
+delivery_modes:
+  - approle-login
+
+approval:
+  model: decision
+  decision_ref: "SECRETS-WP-0004"
+  notes: >-
+    Production auth-capability lane. Live apply and handoff require an approved
+    decision/workplan plus a mode-0600 bootstrap token outside any repo.
+
+verification:
+  positive: "the warden-sign AppRole token has update on every allowlisted ssh/sign role"
+  negative: "the warden-sign AppRole token lacks update on ssh/admin/sys/auth/identity probes"
+
+auth_capability:
+  policy_name: warden-sign
+  role_name: warden-sign
+  token_ttl: 15m
+  token_max_ttl: 15m
+  token_num_uses: 0
+  secret_id_ttl: 30m
+  secret_id_num_uses: 1
+  allowed_paths:
+    - path: ssh/sign/agt-role
+      capabilities: [update]
+    - path: ssh/sign/adm-role
+      capabilities: [update]
+    - path: ssh/sign/atm-role
+      capabilities: [update]
+  denied_probe_paths:
+    - ssh/sign/unlisted-role
+    - ssh/roles/agt-role
+    - ssh/config/ca
+    - sys/policies/acl/warden-sign
+    - auth/token/create
+    - identity/entity/id
+
+rotation:
+  expectation: >-
+    Mint a fresh single-use secret_id for each attended handoff; revoke the
+    resulting token by accessor after the FLEX-WP-0007 T4 smoke or when the 15m
+    TTL expires, whichever comes first.
+  ttl: 15m
+
+deactivation:
+  expectation: >-
+    Delete the warden-sign AppRole and ACL policy, revoke outstanding token
+    accessors, and record non-secret evidence.
+
+audit:
+  evidence: >-
+    policy name, AppRole name, mount, allowed paths, token TTL, role_id file path,
+    secret_id file path, timestamp, result — no token value or secret_id.

catalog/whynot-design-npm-publish.yaml

@@ -55,7 +55,7 @@ delivery_config:
 # Privileged actions on this lane require an approved decision/CCR.
 approval:
   model: decision
-  decision_ref: "whynot-design-npm-publish"   # State Hub decision/CCR id or slug
+  decision_ref: "e6381a56-6b04-4fd5-b2de-f3ef59cde888"   # Canonical State Hub decision UUID; local fixture is offline fallback
   notes: "Production lane: apply requires an approved decision."
 
 # Verification expectations (no value is ever printed).