feat(bootstrap): WARDEN-WP-0001 initial implementation — 42 tests passing

- LocalCA: ssh-keygen -s signing, keypair generation, cert parsing via ssh-keygen -L
- VaultCA: Vault SSH engine backend via httpx
- Inventory: YAML actor registry with ActorType, principals, TTL policy
- Scorecard: four cert-side compliance checks (prefixes, principals, no expired/stale)
- CLI: sign (cert_command interface), issue, status, scorecard, inventory subcommands
- ops-ssh-wrapper: acquire cert and exec SSH command
- Fix: principal parser stops at section headers containing ':' (Critical Options, Extensions)
- Move WARDEN-WP-0001 workplan from ops-bridge; register repo in state-hub (74df727e)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_inventory.py

@@ -1,5 +1,4 @@
 """Tests for warden.inventory."""
-from pathlib import Path
 
 import pytest
 

tests/test_scorecard.py

@@ -1,7 +1,6 @@
 """Tests for warden.scorecard."""
 from pathlib import Path
 
-import pytest
 
 from warden.inventory import ActorEntry, PrincipalsInventory
 from warden.models import ActorType