Read the secrets-engine-openbao client secret in memory from OpenBao

Founder direction 2026-10-06 and ops-mason plan
keycape-secrets-engine-openbao-client-custody (658cdbc): no workstation copy.
service-jwt now gets CLIENT_SECRET from platform/workloads/keycape/
secrets-engine-openbao through one attended OIDC login on
keycape-secrets-engine-openbao-operator-workload-kv-read (-no-store, token from
a pipe, header-only GET, unconditional revoke-self). The consumer file is
refused for this profile and kept for the approval client.
service-auth probe-openbao prints value-free first-use evidence.

SECRETS-WP-0012: T02 cancelled (D1-D4 superseded), T04 done, T03 is the
founder-run first live use. Synthetic tests only; 524 passed, 1 skipped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b

tests/test_engine_auth.py

@@ -80,15 +80,11 @@ def test_explicit_service_jwt_fails_closed_without_contract(tmp_path, monkeypatc
 
 def test_jwt_login_failure_does_not_fall_back_to_env(tmp_path, monkeypatch):
     monkeypatch.setenv("BAO_TOKEN", "must-not-be-used")
-    secret = tmp_path / "client.secret"
-    secret.write_text("client-secret-value", encoding="utf-8")
-    secret.chmod(0o600)
     cfg = _cfg(
         tmp_path,
         openbao_jwt_login_file=_jwt_contract(tmp_path),
         keycape_token_url="https://keycape.example.test/token",
         keycape_issuer="https://keycape.example.test",
-        keycape_client_secret_file=secret,
     )
     monkeypatch.setattr(
         "secrets_engine.engine_auth.KeyCapeServiceAuthProvider.exchange",