Promote forgejo-admin-api-token lane to active (WARDEN-WP-0025 T04)

PAT attended-minted and stored at platform/workloads/forgejo/forgejo-admin
under field API_TOKEN (re-stored from initial Token field to match
CCR/catalog/playbook fetch_command). Positive fetch verified: PAT valid
against forgejo.coulomb.social (/api/v1/user -> login=tegwick, is_admin=true).

- catalog: draft -> active, resolvable: true, verification evidence, reviewed 2026-07-13
- playbook: header active/resolvable, drop post-promotion caveat
- workplan: T04 done

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

registry/routing/catalog.yaml

@@ -287,9 +287,17 @@ entries:
     warden_executes: false
     wiki_ref: wiki/playbooks/forgejo-admin-api-token.md#worker-checklist
     canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
-    reviewed: "2026-07-12"
-    status: draft
-    # CCR-2026-0006 proposed 2026-07-12; policy apply + PAT provision pending platform-operator approval.
+    reviewed: "2026-07-13"
+    status: active
+    resolvable: true
+    # CCR-2026-0006: approved by platform-operator 2026-07-12; policy
+    # workload-kv-read-forgejo-admin + OIDC role forgejo-admin-workload-kv-read live on
+    # bao.coulomb.social; PAT attended-minted and stored under field API_TOKEN at
+    # platform/workloads/forgejo/forgejo-admin (v-latest). Verified 2026-07-13: documented
+    # fetch_command returns non-empty, PAT valid against forgejo.coulomb.social
+    # (/api/v1/user -> login=tegwick, is_admin=true); negative default-policy denial
+    # recorded on CCR. Sibling to forgejo-mailer (SMTP via ESO); phase 1 is
+    # workstation/worker OIDC fetch only, no cluster ExternalSecret.
     auth_method: "caller's own OpenBao token (OIDC netkingdom role forgejo-admin-workload-kv-read)"
     path_template: "platform/workloads/forgejo/forgejo-admin"
     fetch_command: "bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin"