FLEX-WP-0037: register ops-warden actor agt-custodian in the production registry

Add agt-custodian (WARDEN-WP-0045) to examples/ops-warden/production_registry_snapshot.json
so flex-auth-ops-warden stops refusing it with unknown_actor_resource (CUST-WP-0073-T02).
Additions only; regenerated-inventory drift (agt-rehearsal, adm/codex zone fields) not taken.
Tests cover own-principal proceed and foreign-principal disallowed_principal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61

workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md

@@ -0,0 +1,108 @@
+---
+id: FLEX-WP-0037
+type: workplan
+title: "Register ops-warden actor agt-custodian in the signing-policy registry and roll the flex-auth-ops-warden pin"
+domain: infotech
+repo: access-engine
+status: active
+owner: claude
+topic_slug: netkingdom
+created: "2026-10-20"
+updated: "2026-10-20"
+origin: demand
+origin_ref: CUST-WP-0073-T02 (warden sign agt-custodian refused with unknown_actor_resource)
+related: [CUST-WP-0073, WARDEN-WP-0045, FLEX-WP-0016, FLEX-WP-0007]
+---
+
+ops-warden `WARDEN-WP-0045` (commits `e62763c`, `a07c6c7`) added the actor
+`agt-custodian` (type `agt`, principal `agt-custodian`, default and max TTL
+12h, extension `permit-pty`, zone subject workload `custodian-agents`) for the
+supervised interactive custodian agent of `CUST-WP-0073-T02`. The in-cluster
+deployment `flex-auth/flex-auth-ops-warden` serves the registry snapshot baked
+into its image (`/opt/flex-auth/examples/ops-warden/production_registry_snapshot.json`),
+which does not know the actor, so `warden sign agt-custodian` is refused with
+`unknown_actor_resource`.
+
+## Add agt-custodian to the production fixture
+
+```task
+id: FLEX-WP-0037-T01
+status: done
+priority: high
+```
+
+Regenerated the snapshot with ops-warden `scripts/build_flex_auth_registry.py`
+from the live inventory and took **only** the `agt-custodian` elements
+(resource `ssh-cert:actor/agt-custodian`, subject `agt-custodian`, membership
+in `group:ops-warden-agents`, relationship
+`rel:agt-custodian-sign-agt-custodian`). The diff to
+`examples/ops-warden/production_registry_snapshot.json` is additions only.
+
+Drift deliberately not taken (needs its own owner decision):
+
+- live inventory also carries `agt-rehearsal` (principal
+  `rehearsal-inert-nohost`, 2h), which is not in ops-warden's committed
+  snapshot either;
+- the generator now emits `security_zone_admission: unknown` /
+  `catalog_applicability_absent` for `adm-example` (fixture: `not-applicable`,
+  human operator) and drops `workload_id: codex-interhub-bootstrap` from
+  `agt-codex-interhub-bootstrap`.
+
+Validation: `access-engine load-registry` loads 5 subjects / 5 relationships;
+`go test ./...` passes. `TestOpsWardenProductionRegistryActors` gains
+agt-custodian cases: own principal (actor and `iam:` subject) proceeds with
+`advisory_would_signing_policy_matched`; a foreign principal yields
+`advisory_would_disallowed_principal`. Both are `audit_only` because the
+actor's security zone resolves `unknown` (same advisory phase as every other
+agt actor in this fixture).
+
+## Build the image and pin flex-auth-ops-warden
+
+```task
+id: FLEX-WP-0037-T02
+status: progress
+priority: high
+```
+
+Pushing `examples/**` to main triggers `.forgejo/workflows/image.yaml`, which
+publishes `forgejo.coulomb.social/coulomb/flex-auth:main-<short-sha>`. Take the
+digest from the "Report immutable digest" step and set it in
+`values/ops-warden.yaml` only (the fetch pin, `values/ops-warden-fetch.yaml`,
+serves a different registry and stays where it is). Rollback target is the
+current pin `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b`.
+flex-auth has no Argo Application; the pin is applied by an attended Helm
+upgrade, so a pushed pin does not deploy by itself.
+
+## Attended rollout and smoke
+
+```task
+id: FLEX-WP-0037-T03
+status: wait
+priority: high
+needs_human: true
+blocking_reason: "Attended helm upgrade of flex-auth-ops-warden on railiance01 plus an allow smoke; agents may not change the live cluster."
+```
+
+```bash
+helm upgrade --install flex-auth-ops-warden charts/flex-auth \
+  --namespace flex-auth -f values/ops-warden.yaml --wait --timeout 2m
+kubectl -n flex-auth get deploy flex-auth-ops-warden \
+  -o jsonpath='{.spec.template.spec.containers[0].image}'
+```
+
+Smoke through the `127.0.0.1:19090` tunnel (caller auth is `enforce`, so the
+request needs the ops-warden ServiceAccount bearer; the simplest real smoke is
+`warden sign agt-custodian` itself):
+
+```bash
+curl -s -X POST http://127.0.0.1:19090/v1/check \
+  -H 'Content-Type: application/json' -H "Authorization: Bearer $OPS_WARDEN_SA_TOKEN" \
+  -d '{"id":"check:smoke-agt-custodian","tenant":"tenant:platform",
+       "subject":{"id":"agt-custodian","type":"agt"},"action":"sign",
+       "resource":{"id":"ssh-cert:actor/agt-custodian","type":"ssh-certificate","system":"ops-warden"},
+       "context":{"principals":["agt-custodian"],"actor_type":"agt","ttl_hours":1,
+                  "pubkey_fingerprint":"SHA256:smoke"}}'
+```
+
+Expected: `effect` `audit_only` (or `allow` once the zone resolves), reason
+`advisory_would_signing_policy_matched` (not `unknown_actor_resource`).