feat: admit existing OpenBao catalog lanes

src/secrets_engine/openbao.py

@@ -23,6 +23,7 @@ from dataclasses import dataclass
 from pathlib import Path
 
 from secrets_engine.errors import BackendError, ProvisioningError
+from secrets_engine.safe_paths import containing_git_worktree
 
 
 def _check_token_file(path: Path) -> str:
@@ -36,12 +37,12 @@ def _check_token_file(path: Path) -> str:
             f"(mode {oct(st.st_mode & 0o777)}); must be 0600"
         )
     # Refuse a token file living inside a Git worktree.
-    for parent in path.resolve().parents:
-        if (parent / ".git").exists():
-            raise ProvisioningError(
-                f"bootstrap token file {path} is inside a Git worktree ({parent}); "
-                "store it outside any repo"
-            )
+    worktree = containing_git_worktree(path)
+    if worktree is not None:
+        raise ProvisioningError(
+            f"bootstrap token file {path} is inside a Git worktree ({worktree}); "
+            "store it outside any repo"
+        )
     token = path.read_text(encoding="utf-8").strip()
     if not token:
         raise ProvisioningError(f"bootstrap token file {path} is empty")