fix: make the first-run secret warning actionable

[dgenio]

Closes #215.

What changed

• Makes the missing-WEAVER_KERNEL_SECRET warning explain the operational consequence instead of just saying a development secret was generated:
  • process-local random signing state;
  • tokens/audit-chain signatures become invalid after restart;
  • another process does not share that signing state;
  • direct link to production guidance.
• Adds docs/production-checklist.md covering principal authentication, signing secret/key lifecycle, capability classification, allow+deny tests, token use/revocation, mediation coverage, multi-worker consistency, audit retention, redaction limits, protocol versions, supply-chain checks, and fail-closed operational behavior.
• Links the checklist from README.
• Adds tests proving:
  • missing secret logs the actionable warning exactly once;
  • environment secret avoids the warning;
  • explicit constructor secret avoids the warning.

Why

The old warning created the worst combination: friction for first-time evaluators without giving production operators enough information about what the fallback actually means. This keeps the safe default loud, but makes the remediation and consequences explicit.

Deliberate design choice

I did not add a dev_mode=True / warning-suppression flag. Supplying an explicit secret is already the correct acknowledgement path; another switch would create a configuration that is easier to cargo-cult into production.

Compatibility

Warning text changes. Runtime signing semantics are unchanged.

Validation

New tests pin the warning behavior and no runtime authority/policy behavior changes.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Improves the first-run warning when WEAVER_KERNEL_SECRET is missing by making the remediation and operational consequences explicit, and adds operator-facing production guidance.

Changes:

• Update the dev-secret warning message to describe concrete runtime consequences and link to production guidance.
• Add a comprehensive docs/production-checklist.md and link it from the README.
• Add tests to pin warning emission behavior and secret precedence.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
src/weaver_kernel/_secrets.py	Makes the missing-secret warning actionable and links to production checklist.
tests/test_secrets.py	Adds tests for one-time warning behavior and env/explicit secret precedence.
docs/production-checklist.md	Adds operator checklist for production readiness and security posture.
README.md	Links the new production checklist from the docs index section.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.