Harden production authorization and service auth

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

tests/test_privileged_cli_evidence.py

@@ -96,3 +96,28 @@ def test_provision_decision_rejection_is_recorded_before_backend(
     ]
     assert records[-1]["detail"]["approval_status"] == "rejected"
     assert records[-1]["detail"]["decision_ref"] == "CCR-2026-0001"
+
+
+def test_production_handler_fails_closed_before_backend(tmp_path, monkeypatch):
+    data = copy.deepcopy(VALID)
+    data.update(
+        stage="prod",
+        approval={"model": "decision", "decision_ref": "CCR-2026-0001"},
+    )
+    entry = validate_entry(data)
+    monkeypatch.setattr(cli, "get_entry", lambda *_args: entry)
+    monkeypatch.delenv("SECRETS_ENGINE_UNSAFE_DEMO", raising=False)
+    monkeypatch.setattr(
+        cli.OpenBaoClient,
+        "resolve",
+        lambda *_args, **_kwargs: pytest.fail("backend must not be reached"),
+    )
+
+    with pytest.raises(DecisionError, match="production action 'provision'"):
+        cli.cmd_provision(_config(tmp_path), _provision_args(entry))
+
+    records = _records(tmp_path)
+    assert [record["result"] for record in records] == [
+        "attempt",
+        "failed-DecisionError",
+    ]