feat: close WP-0009/WP-0013 production integration stewardship strand

Ship flex-auth policy gate registry and smoke evidence, archive WP-0009
through WP-0013, and add integration docs: ops-bridge cert_command
migration playbook, operator OpenBao token hygiene, principals drift
check script, and 2026-06-24 INTENT/SCOPE gap analysis.

examples/warden.production.example.yaml

@@ -15,10 +15,12 @@ vault:
 inventory_path: ~/.config/warden/inventory.yaml
 state_dir: ~/.local/state/warden
 
-# Opt-in flex-auth gate — keep false until ssh-certificate policies exist
+# Opt-in flex-auth gate — enable only when flex-auth is reachable at flex_auth_url.
+# Registry: registry/flex-auth/production_registry_snapshot.json (build from inventory).
+# See wiki/PolicyGatedSigning.md (operator checklist) and wiki/playbooks/operator-openbao-token-hygiene.md
 policy:
   enabled: false
-  flex_auth_url: http://127.0.0.1:8080
+  flex_auth_url: http://flex-auth.flex-auth.svc.cluster.local:8080
   fail_closed: true
   tenant: tenant:platform
   subject_env: WARDEN_POLICY_SUBJECT