feat: add auth-capability lanes and pilot closeout

Add the warden-sign auth-capability lane, AppRole handoff, verification guards, docs, and tests.

Point the whynot-design pilot at the canonical decision and add the real publish closeout preflight/runbook.

src/secrets_engine/provision.py

@@ -45,6 +45,10 @@ def provision_from_file(
     client: OpenBaoClient, entry: CatalogEntry, field: str, file_path: Path
 ) -> str:
     """Import a value from a strict-permission file. Returns the field name only."""
+    if not entry.stores_kv_value():
+        raise ProvisioningError(
+            f"lane '{entry.id}' is {entry.kind}; it has no KV value to provision"
+        )
     if field not in entry.fields:
         raise ProvisioningError(
             f"field '{field}' not declared in lane '{entry.id}' fields {entry.fields}"
@@ -58,6 +62,10 @@ def provision_from_file(
 
 def provision_generated(client: OpenBaoClient, entry: CatalogEntry, field: str) -> str:
     """Generate a random NON-PRODUCTION value for build/test lanes only."""
+    if not entry.stores_kv_value():
+        raise ProvisioningError(
+            f"lane '{entry.id}' is {entry.kind}; it has no KV value to provision"
+        )
     if entry.stage == "prod":
         raise ProvisioningError(
             f"refusing to generate a value for prod lane '{entry.id}'; "