Revoke leases by operator-held lease id

session revoke accepts exactly one of --accessor-file or --lease-id-file.
Lease ids are read from a mode-0600 out-of-repo file and fingerprinted in
evidence; the handle is never printed. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

docs/cli.md

@@ -60,7 +60,7 @@ secrets-engine exec --catalog <catalog-id> [--field NAME] [--mode auto|npm-confi
 secrets-engine policy publication <catalog-id>
 secrets-engine route <catalog-id> [--json]
 secrets-engine revoke <catalog-id> [--dry-run]
-secrets-engine session revoke --accessor-file F [--stage stage]
+secrets-engine session revoke (--accessor-file F | --lease-id-file F) [--stage stage]
 secrets-engine lifecycle suspend <catalog-id> [--dry-run]
 secrets-engine lifecycle deactivate <catalog-id> [--dry-run]
 secrets-engine lifecycle destroy <catalog-id> [--dry-run] [--confirm-destroy <catalog-id>]

docs/hardening-backlog.md

@@ -75,10 +75,9 @@ contents in this repo.
 ## H4a — Known-accessor operator command
 
 - Delivery sessions already self-revoke in `finally` (`SECRETS-WP-0007-T05`).
-- Implemented: `secrets-engine session revoke --accessor-file F` reads a
-  mode-0600 out-of-repo accessor, calls `token revoke -accessor`, and records
-  only a fingerprint. Production remains fail-closed. Lease-id revoke is still
-  outstanding.
+- Implemented: `secrets-engine session revoke --accessor-file F` or
+  `--lease-id-file F` reads a mode-0600 out-of-repo handle, revokes it, and
+  records only a fingerprint. Production remains fail-closed.
 
 ## H5 — Audit report command