Migrate reuse-surface hub token lane to OpenBao handoff

RAILIANCE-WP-0011-T03: point reuse-surface-hub-write-token catalog,
playbook, and tests at bao kv get on platform/workloads/reuse/reuse-surface/runtime-secrets;
kubectl documented as break-glass only.

tests/test_proxy.py

@@ -64,16 +64,16 @@ def test_resolve_refuses_non_exec_capable():
         resolve_fetch_command(_entry(exec_capable=False, fetch_command=None))
 
 
-def test_resolve_piped_fetch_uses_shell_cmd():
+def test_resolve_bao_fetch_uses_argv():
     from warden.routing import load_catalog
 
     catalog = load_catalog(Path(__file__).resolve().parents[1] / "registry" / "routing" / "catalog.yaml")
     entry = catalog.get("reuse-surface-hub-write-token")
     resolved = resolve_fetch_command(entry)
-    assert resolved.argv is None
-    assert resolved.shell_cmd is not None
-    assert "| base64 -d" in resolved.shell_cmd
-    assert "reuse-surface-env" in resolved.shell_cmd
+    assert resolved.argv is not None
+    assert resolved.shell_cmd is None
+    assert resolved.argv[0] == "bao"
+    assert "platform/workloads/reuse/reuse-surface/runtime-secrets" in resolved.argv
 
 
 # --- G2: transit-only fetch (inherited stdout) -----------------------------