Token APIs and metadata

Read-only services may expose templates, deployment provenance and indexed token metadata. Canonical security decisions should re-read factory/template/token state.

Do not treat a search/index/listing result as proof that a token is current, verified or qualified for another protocol.