adhoc: creds-bootstrap-agent dry-run no longer dies without age key

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

workplans/ADHOC-2026-07-02.md

@@ -0,0 +1,33 @@
+---
+id: adhoc-2026-07-02
+type: workplan
+title: "Ad Hoc Tasks — 2026-07-02"
+domain: infotech
+repo: net-kingdom
+status: finished
+owner: codex
+topic_slug: net-kingdom
+created: "2026-07-02"
+updated: "2026-07-02"
+---
+
+# Ad Hoc Tasks — 2026-07-02
+
+## Fix creds-bootstrap-agent Phase 0 dry-run on machines without the age key
+
+```task
+id: ADHOC-2026-07-02-T01
+status: done
+priority: low
+```
+
+`--dry-run` previously aborted silently in Phase 0 on any machine without
+`~/.config/sops/age/keys.txt`: key generation is correctly skipped in dry-run,
+but the subsequent public-key read (`grep` on the missing file) killed the
+script under `set -e`, so no later phase could be exercised.
+
+Fix: when the key file is absent in dry-run, continue with a placeholder
+recipient and a clear notice instead of dying; live runs without a key still
+fail hard. Verified: full `--dry-run` now traverses Phase 0 through Phase 10
+including the new Phase 7b OpenBao hook (NET-WP-0020-T02) on a machine with
+no age key.