docs+cleanup: HANDOFF rev 5 (placement proven), gotcha 16, key self-revoke

Critical path closed: bridge conversion ($24.73→pUSD, fee-free), executor
ported and round-trip proven ($5 FAK both legs), armed bot restarted clean.
README gains gotcha 16 (pUSD stack: paused native-USDC onramp, bridge is
the sanctioned conversion, builder-key revocation semantics) + bridge/
relayer data-source rows. Probe & wrap scripts atexit-revoke their builder
keys (9 inert ones accumulated during bring-up).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

host/order_probe_v2.py

@@ -43,6 +43,12 @@ with boot:
     bk = boot.create_builder_api_key()
     print("builder key minted (in-process only)")
 client = SecureClient.create(private_key=pk, api_key=bk)
+# builder keys are revocable ONLY by their own secret (HMAC-authed DELETE) —
+# an unrevoked in-process key is inert but sits on the account forever
+# (9 piled up across the 2026-07-10 bring-up). Always revoke on the way out.
+import atexit
+atexit.register(lambda: (client.revoke_builder_api_key(),
+                         print("builder key revoked")))
 for attr in ("wallet", "address", "deposit_wallet"):
     v = getattr(client, attr, None)
     if v:

host/wrap_via_bridge.py

@@ -136,6 +136,11 @@ def main():
         bk = boot.create_builder_api_key()
         print("builder key minted (in-process only)")
     client = SecureClient.create(private_key=pk, api_key=bk)
+    # revoke on ANY exit path — unrevoked keys are inert but pile up forever
+    # (revocation is HMAC-authed by the key's own secret; see order_probe_v2)
+    import atexit
+    atexit.register(lambda: (client.revoke_builder_api_key(),
+                             print("builder key revoked")))
     with client:
         if str(client.wallet).lower() != DW.lower():
             sys.exit(f"client.wallet {client.wallet} != expected {DW} — aborting")