Retag SECRETS-WP-0007 T03-T06 to match shipped work

T03, T05, and T06 are done: lifecycle split, session self-revoke, and
verification/evidence acceptance are in the CLI. T04 waits on the durable
ActionAuthorization serving path rather than looking like local progress.
Known-accessor operator command is residual H4a, not unfinished T03.

Assistant: grok
Assistant-Session: 01a04cea-cb33-7c63-bad7-c1b0f9f0076b

docs/hardening-backlog.md

@@ -61,6 +61,13 @@ contents in this repo.
   state and coordinated provider/workload rotation remain outstanding. Live
   destroy remains disabled until exact-action authorization is available.
 
+## H4a — Known-accessor operator command
+
+- Delivery sessions already self-revoke in `finally` (`SECRETS-WP-0007-T05`).
+- Residual from T03: no general CLI to revoke an already-issued token or
+  lease by a non-secret accessor the operator already holds.
+- Do not print accessors. Prefer fingerprint-only evidence.
+
 ## H5 — Audit report command
 
 - Implemented: `secrets-engine audit <catalog-id>` summarizes allowlisted local