feat: add auth-capability lanes and pilot closeout

Add the warden-sign auth-capability lane, AppRole handoff, verification guards, docs, and tests.

Point the whynot-design pilot at the canonical decision and add the real publish closeout preflight/runbook.

tests/test_catalog.py

@@ -1,4 +1,5 @@
 import copy
+import uuid
 
 import pytest
 
@@ -98,6 +99,10 @@ def test_repo_catalog_loads_and_has_pilot():
     assert pilot.repo == "whynot-design"
     assert pilot.npm["registry"].startswith("https://gitea.coulomb.social/")
     assert pilot.npm["scope"] == "@whynot"
+    # SECRETS-WP-0003 closeout uses the canonical State Hub decision UUID;
+    # the slug-named fixture is retired to offline fallback only.
+    uuid.UUID(pilot.approval["decision_ref"])
+    assert pilot.approval["decision_ref"] == "e6381a56-6b04-4fd5-b2de-f3ef59cde888"
     # build/test/prod stage separation is representable
     stages = {e.stage for e in entries.values()}
     assert {"build", "prod"} <= stages