Add the warden-sign auth-capability lane, AppRole handoff, verification guards, docs, and tests.
Point the whynot-design pilot at the canonical decision and add the real publish closeout preflight/runbook.
- SECRETS-WP-0004: scoped warden-sign OpenBao token lane for ops-warden, to
unblock FLEX-WP-0007 T4 joint smoke. First auth-capability (non-KV) lane and
first lane touching production OpenBao (bao.coulomb.social).
- SCOPE.md: add the standard sections flagged by the repo scope review (Relevant
When, Not Relevant When, How It Fits, Terminology, Related / Overlapping,
Provided Capabilities with fenced capability blocks); refresh Current State to
reflect the delivered MVP.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
