feat(mason): approve the forge read lane and draft its catalog entry

Plan approved 2026-08-26, breadth organisation-wide repository read. The
§4 contingency was satisfied first: STATE-WP-0084-T01 landed the same
day, so a missing grant now surfaces as a named unreadable condition
rather than as silence — which is what the breadth argument rested on.

T01 done. T03 drafted in ops-warden on a branch (entry + playbook +
regenerated high-risk artifact). T02 needs an operator: no valid OpenBao
session here, and the token is the forge owner's to mint.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166

plans/state-hub-forge-derivation-read.md

@@ -3,7 +3,10 @@ id: state-hub-forge-derivation-read
 demand_source: ops-mason/workplans/MASON-WP-0003
 consumer_repo: state-hub
 credential_type: openbao-approle-kv
-status: draft
+status: approved
+approved_by: "Bernd Worsch"
+approved_at: "2026-08-26"
+breadth: organisation-wide-read
 created: "2026-08-26"
 updated: "2026-08-26"
 ---
@@ -172,3 +175,36 @@ repository for retirement, the near-miss that `vergabe-teilnahme` produced.
 2. Breadth: organisation-wide read, or per-repository read.
 3. Rotation: accept build-phase posture (no scheduled `secret_id` expiry), or
    require rotation now.
+
+## 6. Decision (phase 3 outcome)
+
+**Approved 2026-08-26 by Bernd Worsch. Breadth: organisation-wide repository
+read.**
+
+The reasoning, recorded because a bare value would not survive the next person
+asking why:
+
+- **Approved as proposed.** No change to the path, policy, or AppRole shape in
+  §3, and no change to the rejection of `forgejo-admin-api-token` reuse in §2.
+- **Organisation-wide read over per-repository.** The recurring maintenance
+  cost of the narrow option is real and lands on whoever adds a private
+  repository months from now, who has no reason to know this lane exists. The
+  accepted price is the wider leak radius: a leaked token reads every private
+  repository in the organisation — read only, no write, no administration, no
+  persistence.
+- **The contingency in §4 is satisfied.** The recommendation was conditional on
+  `STATE-WP-0084-T01` landing first, so a missing grant would surface as a
+  named condition rather than as silence. It landed on 2026-08-26 (state-hub
+  `85181cd`): an unreadable repository now reports as unreadable, and a source
+  that produced no records cannot retire anything even when retirement is
+  acknowledged.
+- **Rotation: not separately decided; build-phase posture stands** as proposed
+  — no scheduled `secret_id` expiry, matching the existing workload AppRoles.
+  This is the §5 default rather than an explicit ruling, and it is the thing to
+  revisit first when posture changes.
+
+**What approval authorises.** Phase 4 for `MASON-WP-0003-T02` and `T03` only:
+the OpenBao policy, the AppRole, the KV path structure, and the pointer-only
+ops-warden catalog entry. It does not authorise ops-mason to mint or handle the
+token value — the forge owner mints it with organisation-wide repository read
+and no other scope, and `paste_once_provision` delivers it.