feat(mvp): working secrets-engine CLI for the whynot-design npm publish lane

Implements SECRETS-WP-0002 end to end as a uv-managed Python package:

- catalog: non-secret lane registry + strict validator (build/test/prod)
- stage roles + OpenBao ACL policies; guards refuse wildcards, sys/, identity/,
  admin names, and cross-stage paths before any backend call
- plan/apply: dry-run-first, idempotent policy + approle apply, decision-gated
- decisions: State Hub lookup with local-fixture fallback; non-secret evidence
  to JSONL + hub progress, scrubbed of any value
- provision/verify: mode-0600 file import + generated test values; positive/
  negative checks that never print the value
- exec delivery: `exec --catalog ... -- npm publish` injects the token via a
  temp .npmrc for the child only, cleaned up on exit/failure/interrupt
- ops-warden routing contract + hardening backlog docs
- 34 tests incl. live OpenBao integration; scripts/demo-e2e.sh runs the full
  chain against a throwaway bao dev server

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/secrets_engine/exec_delivery.py

@@ -0,0 +1,152 @@
+"""Exec-time delivery: make a secret available only to a child process.
+
+The default and preferred delivery mode. The value is fetched from OpenBao,
+injected into the child's environment / a temp config, the child runs, and the
+injection is destroyed afterward — on success, failure, or interruption.
+
+Supported here:
+  - npm-config: write a temporary .npmrc with the auth token and point the child
+    at it via NPM_CONFIG_USERCONFIG. Preferred for `npm publish`.
+  - exec-env:   inject the value as an environment variable for the child only.
+
+The parent shell never sees the value; the value is never logged. Child stdout/
+stderr is streamed through a redactor as a backstop.
+"""
+from __future__ import annotations
+
+import json
+import os
+import signal
+import subprocess
+import sys
+import tempfile
+from contextlib import contextmanager
+from pathlib import Path
+from typing import Iterator
+
+from secrets_engine.catalog import CatalogEntry
+from secrets_engine.errors import DeliveryError
+from secrets_engine.openbao import OpenBaoClient
+from secrets_engine.redact import redact_text
+
+
+def _fetch_value(client: OpenBaoClient, entry: CatalogEntry, field: str) -> str:
+    """Read the field value via an approle-scoped token. Held in memory only."""
+    try:
+        token = client.approle_login_token(entry.role_name)
+    except Exception as e:
+        raise DeliveryError(f"could not obtain scoped token for delivery: {e}") from e
+    scoped = OpenBaoClient(addr=client.addr, token=token, bao_bin=client.bao_bin)
+    proc = scoped._run(["kv", "get", "-format=json", f"{entry.mount}/{entry.path}"])
+    if proc.returncode != 0:
+        raise DeliveryError(f"scoped read failed for lane '{entry.id}' (denied or absent)")
+    try:
+        data = json.loads(proc.stdout)["data"]["data"]
+    except (json.JSONDecodeError, KeyError) as e:
+        raise DeliveryError(f"malformed KV response for lane '{entry.id}'") from e
+    if field not in data:
+        raise DeliveryError(f"field '{field}' absent in lane '{entry.id}'")
+    return data[field]
+
+
+@contextmanager
+def _npm_userconfig(token: str) -> Iterator[Path]:
+    """Write a mode-0600 temp .npmrc, yield its path, delete it unconditionally."""
+    fd, name = tempfile.mkstemp(prefix="se-npmrc-", suffix=".ini")
+    path = Path(name)
+    try:
+        os.fchmod(fd, 0o600)
+        # Registry-scoped auth token; child npm reads this via NPM_CONFIG_USERCONFIG.
+        with os.fdopen(fd, "w") as fh:
+            fh.write("//registry.npmjs.org/:_authToken=${SE_NPM_TOKEN}\n")
+        yield path
+    finally:
+        try:
+            path.unlink()
+        except FileNotFoundError:
+            pass
+
+
+def _stream_redacted(proc: subprocess.Popen, secret: str) -> None:
+    """Stream child output through the redactor (backstop)."""
+    assert proc.stdout is not None
+    for line in proc.stdout:
+        sys.stdout.write(redact_text(line, extra=[secret]))
+        sys.stdout.flush()
+
+
+def exec_with_secret(
+    client: OpenBaoClient,
+    entry: CatalogEntry,
+    field: str,
+    command: list[str],
+    *,
+    mode: str = "auto",
+) -> int:
+    """Run `command` with the lane's secret injected for the child only.
+
+    Returns the child's exit code. Raises DeliveryError if setup is unsafe.
+    """
+    if not command:
+        raise DeliveryError("no command given to exec")
+
+    declared = set(entry.delivery_modes)
+    if mode == "auto":
+        mode = "npm-config" if "npm-config" in declared else (
+            "exec-env" if "exec-env" in declared else ""
+        )
+    if not mode:
+        raise DeliveryError(
+            f"lane '{entry.id}' declares no exec-capable delivery mode "
+            f"({sorted(declared)})"
+        )
+    if mode not in declared:
+        raise DeliveryError(
+            f"delivery mode '{mode}' not permitted for lane '{entry.id}' "
+            f"(allowed {sorted(declared)})"
+        )
+
+    value = _fetch_value(client, entry, field)
+    child_env = dict(os.environ)
+
+    if mode == "npm-config":
+        with _npm_userconfig(value) as npmrc:
+            child_env["NPM_CONFIG_USERCONFIG"] = str(npmrc)
+            child_env["SE_NPM_TOKEN"] = value
+            rc = _spawn(command, child_env, value)
+        return rc
+
+    if mode == "exec-env":
+        # Inject under a conventional name derived from the field.
+        env_name = field.upper()
+        child_env[env_name] = value
+        return _spawn(command, child_env, value)
+
+    raise DeliveryError(f"unsupported delivery mode '{mode}'")
+
+
+def _spawn(command: list[str], env: dict[str, str], secret: str) -> int:
+    """Spawn the child, stream redacted output, propagate signals, ensure cleanup."""
+    try:
+        proc = subprocess.Popen(
+            command,
+            env=env,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+            text=True,
+        )
+    except FileNotFoundError as e:
+        raise DeliveryError(f"command not found: {command[0]}") from e
+
+    def _forward(signum, _frame):
+        proc.send_signal(signum)
+
+    old_int = signal.signal(signal.SIGINT, _forward)
+    old_term = signal.signal(signal.SIGTERM, _forward)
+    try:
+        _stream_redacted(proc, secret)
+        return proc.wait()
+    finally:
+        signal.signal(signal.SIGINT, old_int)
+        signal.signal(signal.SIGTERM, old_term)
+        # env dict goes out of scope; the temp npmrc is removed by its context mgr.