Add the warden-sign auth-capability lane, AppRole handoff, verification guards, docs, and tests.
Point the whynot-design pilot at the canonical decision and add the real publish closeout preflight/runbook.
SECRETS-WP-0003 scopes the real pilot close-out: canonical State Hub decision,
dedicated Gitea bot account for an enforced repo-scope, real token provisioning,
a real @whynot/design publish through secrets-engine exec, and the ops-warden
routing handoff. Does not change the dormant netkingdom publication-scope gate.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
