Add response-wrapped operator handoff

secrets-engine wrap writes a single-use OpenBao wrap token to a mode-0600
out-of-repo file and never prints it. KV reads and AppRole secret_ids are
wrapped with a 15m TTL cap. Unwrapped secret payloads fail closed.
Production wrap remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

SCOPE.md

@@ -204,7 +204,8 @@ secrets-engine evidence heartbeat|drain|classify
 
 The implemented exec adapters are `exec-env` and `npm-config`. `read-check` is
 verification, `approle-login` is auth-capability handoff metadata, and
-`exec-file`/`wrapped` are reserved schema names without executable adapters.
+`exec-file` remains a reserved schema name without an exec adapter.
+`secrets-engine wrap` implements response-wrapped operator handoff.
 
 ## Proven Operationally
 
@@ -223,7 +224,7 @@ verification, `approle-login` is auth-capability handoff metadata, and
 - A service API, daemon, UI, queue, scheduler, or remote multi-user service.
 - OpenBao JWT login and platform materialization for the implemented KeyCape
   service-auth provider.
-- Native `exec-file` or response-wrapped delivery.
+- Native `exec-file` delivery.
 - Provider-side rotation or coordinated multi-consumer rollout.
 - First-class rotate, compromise, reactivate, lease-status, or audit report
   commands; lifecycle operations currently execute plans without persistent