feat: prepare data-only Anthropic native delivery lane

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

src/secrets_engine/catalog.py

@@ -284,6 +284,8 @@ def validate_entry(data: dict[str, Any], *, source: str = "<memory>") -> Catalog
         delivery_auth = data["delivery_auth"]
         if not isinstance(delivery_auth, dict):
             raise CatalogError(f"{source}: delivery_auth must be a mapping")
+        if "metadata_read" in delivery_auth and not isinstance(delivery_auth["metadata_read"], bool):
+            raise CatalogError(f"{source}: delivery_auth.metadata_read must be boolean")
         auth_method = delivery_auth.get("method", "approle")
         auth_management = delivery_auth.get("management", "engine")
         if auth_method not in VALID_DELIVERY_AUTH_METHODS:

src/secrets_engine/roles.py

@@ -175,10 +175,10 @@ def lane_policy_paths(entry: CatalogEntry) -> dict[str, list[str]]:
     """The minimal KV v2 paths + capabilities a consumer policy needs for a lane."""
     data_path = f"{entry.mount}/data/{entry.path}"
     meta_path = f"{entry.mount}/metadata/{entry.path}"
-    return {
-        data_path: ["read"],
-        meta_path: ["read"],
-    }
+    paths = {data_path: ["read"]}
+    if entry.delivery_auth.get("metadata_read", True):
+        paths[meta_path] = ["read"]
+    return paths
 
 
 def render_policy_hcl(policy_name: str, paths: dict[str, list[str]]) -> str: