feat: complete local layer model v0.7 conformance work

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06eaf-3425-7f92-a0c2-bb4aa4faebe4

tests/test_workload_join.py

@@ -14,9 +14,10 @@ def test_repo_catalog_uses_only_explicit_workload_references():
     assert report["ok"] is True
     assert len(report["resolved"]) == 3
     assert len(report["unknown"]) == 18
-    # 11 since WARDEN-WP-0033: the two NetKingdom SSO lanes (c374d41) are
-    # provider/control-plane credentials, not workload delivery lanes.
-    assert len(report["not_applicable"]) == 11
+    # 12 since WARDEN-WP-0034: the layer-declaration route is repository
+    # conformance guidance, not a workload delivery lane. The two NetKingdom SSO
+    # lanes (c374d41) remain provider/control-plane credentials as well.
+    assert len(report["not_applicable"]) == 12
     assert {row["lane"] for row in report["resolved"]} == {
         "ops-warden-warden-sign-token",
         "issue-core-ingestion-api-key",