Add the acceptance kit for the secrets path

[czpython]

What changes

The acceptance kit for the secrets path moves into the repository, in api-tests/acceptance/.

• check.py runs one provider: it creates a host with an issuer-backed anthropic secret and an issuer-backed github secret, waits for it, and works from inside the box over SSH. The placeholders in a plain session, claude -p, gh api and gh pr list on a private repository, git clone and a push of a throwaway branch and its delete, the placeholder sent straight to Anthropic, a wrong placeholder, the issuer failing, a restart of the exchange, and a clean delete. On docker it restarts the box too. On docker-sbx it checks sbx's store and the value files as well.
• issuer.py is the dummy issuer. It answers from files the operator writes, behind a bearer, and takes two control paths: a fetch count and a fail switch. Standard library only, like the check.
• README.md is the runbook: what to set, how to start the issuer, and what passes. The token files are ignored by git.
• The deploy doc's Verify section and the layout in AGENTS.md point at the kit.

Where this differs from the ticket

• The ticket has the issuer serve {"value", "expires_at"} and be told to fail. The stub does both, and it also counts its fetches, so the check needs no access to a log on another host. The check drives both through the issuer's control URL.
• A wrong placeholder is refused with 401 by Anthropic on docker-sbx, since nothing swaps it, where the exchange answers 403 on the proxy providers. The placeholder sent straight to Anthropic is refused with 401 on every provider, docker-sbx included.
• The anthropic secret lives 70 seconds in the run and the github secret an hour. The short one lets the run see a refresh and an outage. The long one carries the counts: one fetch on first use, one more after a restart of the exchange.

Names

New names, open to change. In check.py: get_setting, call_api, call_issuer, count_fetches, run_on_host, run_in_box, call_claude, get_status, make_entry, PROVIDER_NEEDS_VALUE. In issuer.py: Issuer, mint, is_authorized, answer.

Gates

uv run ruff check, uv run ruff format --check, uv run pyright, and uv run pytest are green.

Acceptance

The kit itself, on this commit, with the subscription token and a one-hour installation token for a private repository behind the dummy issuer:

• docker, on the production bed through our proxy: 21 of 21.
• exe, on the production bed through our proxy over the tailnet, from the Mac: 20 of 20.
• docker-sbx, on the KVM bed with sbx's own secrets: 25 of 25.

Every run ended with a clean delete, and the proxy log carried no credential. No manual step per box: the operator sets the environment once and the check does the rest.

Review

The adversarial review reported seven findings. All seven are applied:

• The stub took its bearer on the command line, where every process could read it. It reads ISSUER_BEARER now.
• A mint path could name a file outside the stub's directory. A service name is plain letters, digits, and dashes now.
• A lost creation response could leave a permanent host, since the check asked for no lease. The host carries a one hour lease, and the cleanup block starts right after creation.
• The outage step proved nothing, since the value was still fresh while the issuer failed. The anthropic secret lives 70 seconds now, the stub counts per service, and the step requires a failed attempt while the box keeps working. The github secret keeps an hour and carries the counts of one fetch per secret and of the restart's cost.
• A failed docker restart could pass the restart step. Its exit code counts now.
• A secret scoped to another sandbox failed the scope check. Only a global row fails it now.
• HOST_ACTIVE_TIMEOUT did not apply to POST /hosts, which provisions before it answers. It does now.

[czpython]

Closed unmerged. The kit lives in the operator's local checkout, untracked, not in the repository. The acceptance results on docker, exe, and docker-sbx stay in this PR's body.