docs(meta): credential key-ladder + EXPOSURE-SEAM lock#1 reconciliation (O2)

[temrjan]

What & why

Doc-first deliverable of the credential arc (parallel to the UniswapX vertical; no code — O1 implementation stays gated to ~M1). Locks the target residence of Rustok's 6 credentials on proven, standard patterns, and reconciles the EXPOSURE-SEAM.md "Three F5 locks" with current reality (the O2 task).

Changes

NEW docs/CREDENTIAL-LADDER.md (axis A — where each secret lives):

• Ladder R0→R4 (standing-shared → scoped+expiring → short-lived-minted → secretless-federation → asymmetric-local+presence), each rung backed by a proven GitHub/SSH/FIDO2 primitive.
• Per-key table with Current + Target + 3-valued status: ci: hardened CI/CD with best practices #1 → R4 mTLS-at-Caddy-edge VERIFIED (server holds the CA only; operator holds cert+key locally); docs: standards map and v1 codebase analysis #2 → R2 short-lived token (UNVERIFIED + task); docs: add org-wide AGENTS.md #3/docs: add PROJECT-STATUS.md #4 OFF-LADDER (the safe itself → self-custody epic); docs: update PROJECT-STATUS.md #5/docs: update PROJECT-STATUS.md #6 → R3/R1 (UNVERIFIED + task).
• Locks the consequence that ci: hardened CI/CD with best practices #1 mTLS requires an operator-local client (an arbitrary hosted connector can't present the client cert) + a dual-run cutover forward-note.
• Frames O1 as a two-axis trigger-bundle (mTLS ci: hardened CI/CD with best practices #1 + approval code-gate + server-side SSE cap limit), not a ladder rung.

EDIT docs/EXPOSURE-SEAM.md "Three F5 locks" (axis B — the O2 reconciliation):

• lock ci: hardened CI/CD with best practices #1 retracted (sole-owner is wrong-by-design — one shared gateway Bearer gates all routes).
• lock docs: standards map and v1 codebase analysis #2 statused design-locked-not-yet-live (request_swap absent in mcp/src; sign_message still a tool with EXECUTE_TX → Slice 2c).
• lock docs: add org-wide AGENTS.md #3 statused done-on-gateway (core #71) / MCP enum-drop pending 2c.
• Closes F6: the orchestrator holds docs: standards map and v1 codebase analysis #2 (a service cred); "not on our server" applies only to ci: hardened CI/CD with best practices #1.

Honesty gate (merge-DoD)

No rung is VERIFIED without an inline source; everything else is UNVERIFIED + a named task, or OFF-LADDER. file:line claims re-verified against current code. The two docs cross-link.