fix(api): expose credential escrow safe next step

apps/api/tests/test_credential_escrow_evidence_intake_readiness_api.py

@@ -27,6 +27,10 @@ def test_credential_escrow_evidence_intake_reports_p0_blocker():
     assert payload["schema_version"] == "credential_escrow_evidence_intake_readiness_v1"
     assert payload["priority"] == "P0-005"
     assert payload["status"] == "blocked_waiting_non_secret_credential_escrow_evidence"
+    assert payload["safe_next_step"] == (
+        "collect_redacted_non_secret_evidence_refs_then_rerun_preflight"
+    )
+    assert payload["readback"]["safe_next_step"] == payload["safe_next_step"]
     assert payload["rollups"]["required_item_count"] == 5
     assert payload["rollups"]["missing_item_count"] == 5
     assert payload["rollups"]["effective_escrow_missing_count"] == 5
@@ -56,6 +60,9 @@ def test_credential_escrow_evidence_intake_endpoint_returns_readiness():
     assert response.status_code == 200
     data = response.json()
     assert data["priority"] == "P0-005"
+    assert data["safe_next_step"] == (
+        "collect_redacted_non_secret_evidence_refs_then_rerun_preflight"
+    )
     assert data["rollups"]["missing_item_count"] == 5
     assert data["operation_boundaries"]["restore_execution_allowed"] is False
     assert data["operation_boundaries"]["workflow_trigger_allowed"] is False