docs: fix secret-distribution.md evidence command, bump verify

The registry-token example's shown grep command didn't actually
reproduce the shown output (it matched the first 'service: automation'
entry, gitea, not registry-token). Fixed to grep on the registry-token
path directly, so the command is genuinely reproducible. Re-verified
everything else live: SSH cert flow's 2h timer, the technitium API
token lookup snippet, and the flow diagram - all accurate.

docs/secret-distribution.md

@@ -1,6 +1,6 @@
-<!-- verified: 2026-09-06
-     iac@49ff427 : ansible/roles/secure_vault/ssh_ca_client, ansible/roles/secure_vault/vault_agent/defaults/main.yml, ansible/roles/secure_vault/SecureVault – Vault Contract.md, ansible/roles/secure_vault/securevault-vault-facts.md
-     ansible@ccbda37 : roles/app_update/defaults/main.yml
+<!-- verified: 2026-09-19
+     iac@f770e1c : ansible/roles/secure_vault/ssh_ca_client, ansible/roles/secure_vault/vault_agent/defaults/main.yml, ansible/roles/secure_vault/SecureVault – Vault Contract.md, ansible/roles/secure_vault/securevault-vault-facts.md
+     ansible@24e1bf0 : roles/app_update/defaults/main.yml
      trilium : DvKxK0gHXsng, wovVrgvoDVy2, GW8BMoTKtRBe, 1seDR2nBmxKO
 -->
 
@@ -80,7 +80,7 @@ That redeploy-and-restart sequence isn't just a claim — here's a real one, sta
 **Shared-secret variant:** not every template is host-scoped — one credential needed by every docker host for its own registry pushes (see [`docs/registry-and-build.md`](registry-and-build.md)) is templated from a single shared path rather than a per-host one. Same mechanics, just a shared source instead of a private one — and it relies on every host's policy already granting read access to that shared path, the same "shared + private" pattern described in [`docs/secrets-and-pki.md`](secrets-and-pki.md)'s access model. This is the real template list entry, repeated per host:
 
 ```
-$ grep -A4 "service: automation" vault_agent/defaults/main.yml
+$ grep -B1 -A3 "registry-token.ctmpl" vault_agent/defaults/main.yml
 - service: automation
   src_path: .../automation-vm/registry-token/registry-token.ctmpl
   dest_path: /opt/docker/docker_volumes/registry-token/registry-token