Add value-safe verification and audit reporting

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

docs/whynot-design-real-publish-closeout.md

@@ -70,9 +70,14 @@ BAO_ADDR=https://bao.coulomb.social \
 BAO_ADDR=https://bao.coulomb.social \
   secrets-engine verify whynot-design-npm-publish \
   --field npm_token --positive --negative \
+  --negative-token-file /secure/path/reviewed-unrelated.token \
   --bootstrap-token-file ~/.secrets-engine/bootstrap/prod-whynot-design.token
 ```
 
+The unrelated token must represent a reviewed identity outside the lane policy;
+it is not the bootstrap token and must be held in a separate mode-0600 file
+outside Git.
+
 6. In the `whynot-design` repo, coordinate a real version bump. Run the publish
    through child-only injection: