addendum 26: DOCFIX-094 stderr-separation fixes (cloud-assert fail-open closed) + vault snap-track measurements + juju auth-expiry blocker ...

Gauntlet ALL GREEN (32 harnesses; cloud-assert 12/12 incl. new fail-open
proof cases). Read-only vault measurements landed before the juju macaroon
expired; operator needs interactive 'juju login' for the remaining reads.

Revert: per addendum-26 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

addendum 23: H2 stage-3 re-run guards + H3 canary stage7 (tenant-onboard.sh), harness 2->12 cases ...

Gauntlet ALL GREEN. No cloud state touched; stage7 is explicit-only and
self-cleaning, VERIFY-LIVE flags in header for ssh user + flavor.

Revert: per addendum-23 REVERT line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Patches

Documentation deployment

Barbican-Vault fixes

Tenant file updates