Repo hygiene: fill stack-and-commands, normalize workplan statuses

- Fill .claude/rules/stack-and-commands.md (was an empty TODO template)
- Normalize workplan frontmatter statuses to canonical vocabulary
  (completed/done -> finished) per ADR-001
- Repair glued frontmatter delimiter in NK-WP-0001 (superseded_by line)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/responsibility-map.md

@@ -76,6 +76,17 @@ and what NetKingdom is responsible for (meta-orchestration).
 | **Repo owns** | operating these stateful services to durability/recovery guarantees behind stable interfaces |
 | **NetKingdom orchestrates** | which platform services a scenario needs; runtime secret-authority boundaries (platform-root vs tenant) and policies; backup/DR requirements; the identity-integration point; runtime-secret-trust readiness |
 
+### `secrets-engine` — secret workflow and delivery orchestration
+
+| | |
+| --- | --- |
+| **Resources held** | non-secret secret-lane catalog, stage policy model, delivery-mode contracts, OpenBao apply/delivery plans, readiness and evidence records |
+| **Repo owns** | workflow and automation mechanics for approved secret establishment, provisioning, verification, delivery, rotation, revocation, and deactivation |
+| **NetKingdom orchestrates** | secret organization concepts; build/test/production stage boundaries; which systems participate in decisions and delivery; OpenBao/flex-auth/user-engine/ops-warden/ops-bridge/info-tech-canon interaction boundaries; the rule that OpenBao remains custody and audit backend |
+
+See `docs/secrets-engine-security-infrastructure-boundary.md` for the canonical
+cross-system boundary and interaction model.
+
 ### `key-cape` — identity
 
 | | |