feat: add auth-capability lanes and pilot closeout

Add the warden-sign auth-capability lane, AppRole handoff, verification guards, docs, and tests.

Point the whynot-design pilot at the canonical decision and add the real publish closeout preflight/runbook.

scripts/whynot-real-publish-preflight.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Non-secret source-side preflight for SECRETS-WP-0003.
+set -euo pipefail
+
+DECISION_ID="e6381a56-6b04-4fd5-b2de-f3ef59cde888"
+CATALOG_ID="whynot-design-npm-publish"
+
+if [[ -d .venv ]]; then
+  # shellcheck disable=SC1091
+  source .venv/bin/activate
+fi
+
+if command -v secrets-engine >/dev/null 2>&1; then
+  SECRETS_ENGINE=(secrets-engine)
+else
+  export PYTHONPATH="src${PYTHONPATH:+:$PYTHONPATH}"
+  SECRETS_ENGINE=(python3 -m secrets_engine.cli)
+fi
+
+export SECRETS_ENGINE_EVIDENCE="${SECRETS_ENGINE_EVIDENCE:-/tmp/secrets-engine-whynot-preflight-evidence}"
+
+echo "### decision"
+"${SECRETS_ENGINE[@]}" decision inspect "$DECISION_ID"
+
+echo
+echo "### publication policy"
+"${SECRETS_ENGINE[@]}" policy publication "$CATALOG_ID"
+
+echo
+echo "### route pointer"
+"${SECRETS_ENGINE[@]}" route "$CATALOG_ID" --json