Apply, provision, and verify the prod lane on live OpenBao, publish
@whynot/design@0.4.1 through native secrets-engine exec, and teach the
OpenBao client to tolerate stage-role mount/approle probes when sys/mounts
and sys/auth are denied.
Add the warden-sign auth-capability lane, AppRole handoff, verification guards, docs, and tests.
Point the whynot-design pilot at the canonical decision and add the real publish closeout preflight/runbook.
SECRETS-WP-0003 scopes the real pilot close-out: canonical State Hub decision,
dedicated Gitea bot account for an enforced repo-scope, real token provisioning,
a real @whynot/design publish through secrets-engine exec, and the ops-warden
routing handoff. Does not change the dormant netkingdom publication-scope gate.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
