feat(mvp): working secrets-engine CLI for the whynot-design npm publish lane

Implements SECRETS-WP-0002 end to end as a uv-managed Python package:

- catalog: non-secret lane registry + strict validator (build/test/prod)
- stage roles + OpenBao ACL policies; guards refuse wildcards, sys/, identity/,
  admin names, and cross-stage paths before any backend call
- plan/apply: dry-run-first, idempotent policy + approle apply, decision-gated
- decisions: State Hub lookup with local-fixture fallback; non-secret evidence
  to JSONL + hub progress, scrubbed of any value
- provision/verify: mode-0600 file import + generated test values; positive/
  negative checks that never print the value
- exec delivery: `exec --catalog ... -- npm publish` injects the token via a
  temp .npmrc for the child only, cleaned up on exit/failure/interrupt
- ops-warden routing contract + hardening backlog docs
- 34 tests incl. live OpenBao integration; scripts/demo-e2e.sh runs the full
  chain against a throwaway bao dev server

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/hardening-backlog.md

@@ -0,0 +1,58 @@
+# Hardening Backlog — Exit From Bootstrap Mode
+
+The MVP runs in **bootstrap mode**: stage roles may be driven by temporary
+root-created OpenBao tokens read from mode-0600 files. That is acceptable setup
+material, **not** the steady state. This backlog tracks the work to retire it.
+
+The MVP is honest about this: bootstrap mode is a documented, bounded phase with
+explicit revocation tasks — not a hidden permanent security posture.
+
+## H0 — Revoke outstanding bootstrap tokens (always-on hygiene)
+
+Every minted bootstrap token has a revocation task. Track each here:
+
+| Token file | Stage | Minted | TTL | Revoked? |
+| --- | --- | --- | --- | --- |
+| `~/.secrets-engine/bootstrap/prod.token` | prod | (n/a — demo uses dev server) | 1h | n/a |
+
+Revoke: `bao token revoke -accessor <accessor>` then `shred -u <file>`.
+
+## H1 — Replace bootstrap token files with OIDC / service auth
+
+- Stand up an OpenBao auth method (OIDC or AppRole bound to a workload identity)
+  for each stage role.
+- secrets-engine logs in via that method instead of reading a token file.
+- Remove `--bootstrap-token-file` from the steady-state path (keep only for true
+  break-glass, heavily audited).
+
+## H2 — Response-wrapped handoff
+
+- Add a `wrapped` delivery mode using OpenBao response wrapping for operator
+  handoff flows where exec-time injection does not fit.
+
+## H3 — Production dual-control
+
+- Require two-person approval (`approval.model: dual-control`) for prod value
+  provisioning before automating raw-value writes beyond the pilot.
+
+## H4 — Rotation & lifecycle states
+
+- Implement `rotate`, and explicit `compromised` / `deactivated` lane states with
+  evidence, beyond the current `revoke` (metadata delete).
+
+## H5 — Audit report command
+
+- `secrets-engine audit <catalog-id>` summarizing non-secret evidence (decision,
+  applies, provisions, verifications, execs, revokes) for a lane.
+
+## H6 — API service mode
+
+- Expose the stabilized CLI semantics as a local service API for ops-warden,
+  CI, agents, and a future UI — **after** the CLI contract is proven.
+
+## Exit criteria for "bootstrap mode is over"
+
+- No steady-state flow reads a bootstrap token file.
+- Every stage role authenticates through OIDC/service auth.
+- Production provisioning beyond the pilot requires dual-control.
+- Rotation and deactivation are first-class, evidenced operations.