Implement WP-0022 audit trail and WP-0023 INTENT–SCOPE closeout

Add unified metadata-only audit.jsonl with secret-material guard, instrument
sign/access/worker paths, and expose warden activity CLI. Surface broker hint
when VAULT_TOKEN is unset, refresh INTENT/SCOPE docs, and add production
integration checklists plus catalog lane promotion playbook.

wiki/playbooks/ops-bridge-tunnel-cert.md

@@ -135,9 +135,35 @@ pilot. Migrate per-tunnel when ops-bridge owner prioritizes them.
 
 ---
 
+## Live cutover evidence template
+
+When ops-bridge completes the pilot cutover, record **non-secret** evidence only.
+Post a State Hub progress note or save under `history/` with these fields:
+
+| Field | Example / instruction |
+| --- | --- |
+| Tunnel id | `state-hub-coulombcore` |
+| Actor | `agt-state-hub-bridge` |
+| Readiness gate | `check_tunnel_cert_readiness.py` exit code + date |
+| First `bridge up` success | ISO timestamp (tunnel established) |
+| First warden-signed connection | ISO timestamp from `signatures.log` or `warden activity --kind sign` |
+| `cert_command` in use | yes / no |
+| Rollback tested | yes / no — static-key path still available until verified |
+| Operator | human handle or agent id |
+| Cross-links | ops-bridge session notes, this playbook |
+
+**Do not** include `VAULT_TOKEN`, private keys, cert bodies, or host passwords in
+evidence. Use `warden activity --days 1 --kind sign --json` for sign metadata.
+
+Coordination: message `ops-bridge` on State Hub with pointer to this template when
+starting cutover (WARDEN-WP-0023).
+
+---
+
 ## See also
 
 - `wiki/CertCommandInterface.md`
 - `wiki/OpsWardenConfig.md` — cert_command example
 - `wiki/playbooks/operator-openbao-token-hygiene.md`
+- `wiki/AuditTrail.md` — query recent signs via `warden activity`
 - `warden route show ops-bridge-tunnel --json`