feat(mvp): working secrets-engine CLI for the whynot-design npm publish lane

Implements SECRETS-WP-0002 end to end as a uv-managed Python package:

- catalog: non-secret lane registry + strict validator (build/test/prod)
- stage roles + OpenBao ACL policies; guards refuse wildcards, sys/, identity/,
  admin names, and cross-stage paths before any backend call
- plan/apply: dry-run-first, idempotent policy + approle apply, decision-gated
- decisions: State Hub lookup with local-fixture fallback; non-secret evidence
  to JSONL + hub progress, scrubbed of any value
- provision/verify: mode-0600 file import + generated test values; positive/
  negative checks that never print the value
- exec delivery: `exec --catalog ... -- npm publish` injects the token via a
  temp .npmrc for the child only, cleaned up on exit/failure/interrupt
- ops-warden routing contract + hardening backlog docs
- 34 tests incl. live OpenBao integration; scripts/demo-e2e.sh runs the full
  chain against a throwaway bao dev server

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

workplans/REPO-WP-0001-statehub-bootstrap.md

@@ -1,67 +0,0 @@
----
-id: REPO-WP-0001
-type: workplan
-title: "Bootstrap State Hub integration"
-domain: infotech
-repo: repo-seed
-status: finished
-owner: codex
-topic_slug: infotech
-created: "2026-06-22"
-updated: "2026-06-22"
-state_hub_workstream_id: "b809c762-8675-470c-be3e-0e5552f7d79d"
----
-
-# Bootstrap State Hub integration
-
-Git repository template to bootstrap coulomb projects.
-
-## Review Generated Integration Files
-
-```task
-id: REPO-WP-0001-T01
-status: done
-priority: high
-state_hub_task_id: "65734e48-ec48-47f2-bd5c-5673e94343cc"
-
-```
-
-Result 2026-06-22: Filled SCOPE.md; README is canonical intent.
-
-Review `INTENT.md`, `SCOPE.md`, `AGENTS.md`, and `.custodian-brief.md`.
-Replace generated placeholders with repo-specific facts where needed.
-
-## Verify Local Developer Workflow
-
-```task
-id: REPO-WP-0001-T02
-status: done
-priority: high
-state_hub_task_id: "76f1c245-3f06-4ef7-943f-bf2e9722c71b"
-
-```
-
-Result 2026-06-22: Template workflow documented.
-
-Identify the repo's install, test, lint, build, and run commands. Add or refine
-those commands in the agent instructions so future coding sessions can verify
-changes confidently.
-
-## Seed First Real Workplan
-
-```task
-id: REPO-WP-0001-T03
-status: done
-priority: medium
-state_hub_task_id: "9670ff11-ed7a-49e6-8a1f-944af9794f6a"
-
-```
-
-Result 2026-06-22: Created REPO-WP-0002.
-
-Create the first implementation workplan for the repository's most important
-next change. After workplan file updates, run from `~/state-hub`:
-
-```bash
-make fix-consistency REPO=repo-seed
-```