Revoke leases by operator-held lease id

session revoke accepts exactly one of --accessor-file or --lease-id-file.
Lease ids are read from a mode-0600 out-of-repo file and fingerprinted in
evidence; the handle is never printed. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

src/secrets_engine/openbao.py

@@ -353,6 +353,12 @@ class OpenBaoClient:
             raise BackendError("token accessor is missing or invalid")
         self._run_ok(["token", "revoke", "-accessor", accessor])
 
+    def revoke_lease(self, lease_id: str) -> None:
+        """Revoke a lease the operator already holds, by lease id only."""
+        if not lease_id or any(ch.isspace() for ch in lease_id):
+            raise BackendError("lease id is missing or invalid")
+        self._run_ok(["lease", "revoke", lease_id])
+
     def _parse_wrap_response(self, stdout: str, *, ttl: str, creation_path: str) -> WrappedResponse:
         try:
             payload = json.loads(stdout)