feat(mvp): working secrets-engine CLI for the whynot-design npm publish lane

Implements SECRETS-WP-0002 end to end as a uv-managed Python package:

- catalog: non-secret lane registry + strict validator (build/test/prod)
- stage roles + OpenBao ACL policies; guards refuse wildcards, sys/, identity/,
  admin names, and cross-stage paths before any backend call
- plan/apply: dry-run-first, idempotent policy + approle apply, decision-gated
- decisions: State Hub lookup with local-fixture fallback; non-secret evidence
  to JSONL + hub progress, scrubbed of any value
- provision/verify: mode-0600 file import + generated test values; positive/
  negative checks that never print the value
- exec delivery: `exec --catalog ... -- npm publish` injects the token via a
  temp .npmrc for the child only, cleaned up on exit/failure/interrupt
- ops-warden routing contract + hardening backlog docs
- 34 tests incl. live OpenBao integration; scripts/demo-e2e.sh runs the full
  chain against a throwaway bao dev server

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -1,18 +1,68 @@
-Headless multi-application, multi-tenant secrets mangement engine. 
+# secrets-engine
 
-# repo-seed
+Headless, multi-application, multi-tenant secrets workflow and automation layer
+for approved secret custody, delivery, and lifecycle work across build, test,
+and production stages.
 
-A git repository template to bootstrap coulomb projects from.
+OpenBao remains the custody and enforcement backend. `secrets-engine` owns the
+operator and agent interaction model: catalog, decision checks, plan/apply,
+safe provisioning, verification, delivery, evidence, rotation, and deactivation.
 
-## Bootstrap a new repo
+## Start Here
 
-1. Clone or copy this template into a new repository.
-2. Run `statehub register` from the new repo root (see [docs/statehub-register.md](docs/statehub-register.md)).
-3. Complete the generated bootstrap workplan (`*-0001-statehub-bootstrap.md`).
-4. Sync workplans: `cd ~/state-hub && make fix-consistency REPO=<slug>`.
-5. Validate with [docs/template-validation-checklist.md](docs/template-validation-checklist.md).
+- [INTENT.md](INTENT.md) - why this repository exists.
+- [ProductRequirementsDocument.md](ProductRequirementsDocument.md) - product
+  requirements and MVP scope.
+- [NetKingdom security infrastructure boundary pointer](docs/netkingdom-security-infrastructure.md)
+  - points to the canonical document in `net-kingdom/docs/`, covering
+  responsibilities and interactions with OpenBao, flex-auth, user-engine,
+  ops-warden, ops-bridge, info-tech-canon, State Hub, and agents.
+- [Bootstrap MVP workplan](workplans/SECRETS-WP-0002-bootstrap.md) - first
+  implementation plan after State Hub bootstrap.
 
-## Registry
+## Core Direction
 
-This repo publishes `capability.infotech.repo-template` — see
-`registry/capabilities/capability.infotech.repo-template.md`.
+The MVP proves the `whynot-design-npm-publish` lane end to end:
+
+1. describe the lane in a non-secret catalog (`catalog/`);
+2. verify an approved decision (State Hub or local fixture);
+3. apply OpenBao policy/auth metadata through a stage-aware role;
+4. provision and verify the value without printing it;
+5. run a workload command through safe exec-time delivery.
+
+Target command shape:
+
+```bash
+secrets-engine exec --catalog whynot-design-npm-publish -- npm publish
+```
+
+## Quickstart
+
+```bash
+uv venv && uv pip install -e ".[dev]"
+source .venv/bin/activate
+secrets-engine catalog list
+
+# Run the whole pilot chain live against a throwaway OpenBao dev server:
+SECRETS_ENGINE_HUB_URL="" bash scripts/demo-e2e.sh
+```
+
+- CLI reference: [docs/cli.md](docs/cli.md)
+- Stage roles & bootstrap tokens: [docs/openbao-stage-roles.md](docs/openbao-stage-roles.md)
+- ops-warden routing contract: [docs/ops-warden-routing-contract.md](docs/ops-warden-routing-contract.md)
+- Hardening backlog (exit bootstrap mode): [docs/hardening-backlog.md](docs/hardening-backlog.md)
+
+The implementation is a Python package (`src/secrets_engine/`). OpenBao is
+reached only through the `bao` CLI adapter (`openbao.py`); the rest of the code
+speaks in lanes and guarded plans.
+
+## Security Rules
+
+- Do not put raw secret values in Git, State Hub, chat, prompts, issue comments,
+  workplans, or normal logs.
+- OpenBao is the backend custody and audit authority.
+- Build, test, and production have separate policy boundaries.
+- Production actions require approved decisions except explicit break-glass
+  flows.
+- Temporary bootstrap OpenBao credentials must live outside repos, use mode
+  0600, be revocable, and be removed after narrower auth is working.