SECRETS-WP-0003 scopes the real pilot close-out: canonical State Hub decision,
dedicated Gitea bot account for an enforced repo-scope, real token provisioning,
a real @whynot/design publish through secrets-engine exec, and the ops-warden
routing handoff. Does not change the dormant netkingdom publication-scope gate.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
