addendum 26: DOCFIX-094 stderr-separation fixes (cloud-assert fail-open closed) + vault snap-track measurements + juju auth-expiry blocker ...

Gauntlet ALL GREEN (32 harnesses; cloud-assert 12/12 incl. new fail-open
proof cases). Read-only vault measurements landed before the juju macaroon
expired; operator needs interactive 'juju login' for the remaining reads.

Revert: per addendum-26 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 25: DOCFIX-093 batch-3 window do-doc + OpenBao research draft + H5 embed + stderr-sweep inventory ...

Operator-away autonomous batch complete (addenda 23-25). Repo-side queue
empty except H4 (main-chat backlog coordination) ; all remaining work is
the operator-present live window per the new do-doc.

Revert: per addendum-25 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 21: DOCFIX-091 tenant onboarding contract (A1 rulings) ...

New docs/tenant-onboarding-contract.md: operator/tenant boundary + rationale,
explicit role table (manager persona, never admin), tenant intake list,
stage dangers, onboarding confirmation set, hardening register H1-H5
(proposals logged, none implemented). v2-DRAFT banner defers to it.

Revert: per addendum-21 REVERT line (doc-only; no cloud state touched).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Tenant file updates

Phase 8 updates