feat: add auth-capability lanes and pilot closeout

Add the warden-sign auth-capability lane, AppRole handoff, verification guards, docs, and tests.

Point the whynot-design pilot at the canonical decision and add the real publish closeout preflight/runbook.

src/secrets_engine/verify.py

@@ -68,14 +68,94 @@ def verify_negative(client: OpenBaoClient, entry: CatalogEntry) -> VerifyResult:
     )
 
 
+def verify_auth_capability_positive(client: OpenBaoClient, entry: CatalogEntry) -> VerifyResult:
+    """Approved AppRole token must carry update on every exact allowed path."""
+    try:
+        token = client.approle_login_token(entry.role_name)
+    except Exception as e:
+        return VerifyResult(
+            "positive",
+            False,
+            {"reason": f"could not obtain approle token: {e}", "role": entry.role_name},
+        )
+    missing: list[str] = []
+    for path in entry.auth_allowed_paths:
+        try:
+            caps = client.token_capabilities(path, token=token)
+        except Exception as e:
+            return VerifyResult(
+                "positive",
+                False,
+                {"reason": f"could not inspect capabilities: {e}", "path": path},
+            )
+        if "update" not in caps:
+            missing.append(path)
+    passed = not missing
+    return VerifyResult(
+        "positive",
+        passed,
+        {
+            "reason": "approle token can update every allowlisted path"
+            if passed
+            else "approle token lacks update on allowlisted paths",
+            "role": entry.role_name,
+            "allowed_paths": sorted(entry.auth_allowed_paths),
+            "missing_update": missing,
+        },
+    )
+
+
+def verify_auth_capability_negative(client: OpenBaoClient, entry: CatalogEntry) -> VerifyResult:
+    """Approved AppRole token must not gain update outside denial probes."""
+    try:
+        token = client.approle_login_token(entry.role_name)
+    except Exception as e:
+        return VerifyResult(
+            "negative",
+            False,
+            {"reason": f"could not obtain approle token: {e}", "role": entry.role_name},
+        )
+    leaks: list[str] = []
+    for path in entry.auth_denied_probe_paths:
+        try:
+            caps = client.token_capabilities(path, token=token)
+        except Exception as e:
+            return VerifyResult(
+                "negative",
+                False,
+                {"reason": f"could not inspect capabilities: {e}", "path": path},
+            )
+        if "update" in caps or "sudo" in caps or "root" in caps:
+            leaks.append(path)
+    passed = not leaks
+    return VerifyResult(
+        "negative",
+        passed,
+        {
+            "reason": "denial probes lack update capability"
+            if passed
+            else "approle token can update outside the allowlist",
+            "role": entry.role_name,
+            "denied_probe_paths": entry.auth_denied_probe_paths,
+            "leaks": leaks,
+        },
+    )
+
+
 def run_verification(
     client: OpenBaoClient, entry: CatalogEntry, field: str, *, positive: bool, negative: bool
 ) -> list[VerifyResult]:
     results: list[VerifyResult] = []
-    if positive:
-        results.append(verify_positive(client, entry, field))
-    if negative:
-        results.append(verify_negative(client, entry))
+    if entry.kind == "auth-capability":
+        if positive:
+            results.append(verify_auth_capability_positive(client, entry))
+        if negative:
+            results.append(verify_auth_capability_negative(client, entry))
+    else:
+        if positive:
+            results.append(verify_positive(client, entry, field))
+        if negative:
+            results.append(verify_negative(client, entry))
     if not results:
         raise VerificationError("no verification check selected (use --positive/--negative)")
     return results