Promote forgejo-admin-api-token lane to active (WARDEN-WP-0025 T04)

PAT attended-minted and stored at platform/workloads/forgejo/forgejo-admin
under field API_TOKEN (re-stored from initial Token field to match
CCR/catalog/playbook fetch_command). Positive fetch verified: PAT valid
against forgejo.coulomb.social (/api/v1/user -> login=tegwick, is_admin=true).

- catalog: draft -> active, resolvable: true, verification evidence, reviewed 2026-07-13
- playbook: header active/resolvable, drop post-promotion caveat
- workplan: T04 done

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

registry/routing/catalog.yaml

@@ -287,9 +287,17 @@ entries:
     warden_executes: false
     wiki_ref: wiki/playbooks/forgejo-admin-api-token.md#worker-checklist
     canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
-    reviewed: "2026-07-12"
+    reviewed: "2026-07-13"
-    status: draft
+    status: active
-    # CCR-2026-0006 proposed 2026-07-12; policy apply + PAT provision pending platform-operator approval.
+    resolvable: true
+    # CCR-2026-0006: approved by platform-operator 2026-07-12; policy
+    # workload-kv-read-forgejo-admin + OIDC role forgejo-admin-workload-kv-read live on
+    # bao.coulomb.social; PAT attended-minted and stored under field API_TOKEN at
+    # platform/workloads/forgejo/forgejo-admin (v-latest). Verified 2026-07-13: documented
+    # fetch_command returns non-empty, PAT valid against forgejo.coulomb.social
+    # (/api/v1/user -> login=tegwick, is_admin=true); negative default-policy denial
+    # recorded on CCR. Sibling to forgejo-mailer (SMTP via ESO); phase 1 is
+    # workstation/worker OIDC fetch only, no cluster ExternalSecret.
     auth_method: "caller's own OpenBao token (OIDC netkingdom role forgejo-admin-workload-kv-read)"
     path_template: "platform/workloads/forgejo/forgejo-admin"
     fetch_command: "bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin"

wiki/playbooks/forgejo-admin-api-token.md

@@ -1,7 +1,7 @@
 # Forgejo Admin API Token (PAT)
 
-Date: 2026-07-12  
+Date: 2026-07-12 (verified 2026-07-13)  
-Catalog: `forgejo-admin-api-token` (status `draft`, `resolvable: false` until verified)  
+Catalog: `forgejo-admin-api-token` (status `active`, `resolvable: true`)  
 Owner: `railiance-platform` (CCR-2026-0006)
 
 Forgejo site-admin personal access token for operator and automation tooling.
@@ -45,7 +45,7 @@ worker fetch only — no cluster ExternalSecret delivery.
    )
    ```
 
-3. **Or proxy via warden access** (after catalog promotion):
+3. **Or proxy via warden access** (catalog lane is `active`):
 
    ```bash
    warden access forgejo-admin-api-token --no-policy --fetch --field API_TOKEN

workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md

@@ -74,16 +74,20 @@ state_hub_task_id: "65dcbf2f-28e1-42c8-8419-a766e3087502"
 
 ```task
 id: WARDEN-WP-0025-T04
-status: progress
+status: done
 priority: high
 state_hub_task_id: "bc249196-8692-434a-91b1-4232951246dd"
 ```
 
-- [ ] Mint PAT as Forgejo user `tegwick` (attended)
+- [x] Mint PAT as Forgejo user `tegwick` (attended, 2026-07-12)
-- [ ] `scripts/forgejo-admin-pat-provision.sh` → `platform/workloads/forgejo/forgejo-admin`
+- [x] Stored at `platform/workloads/forgejo/forgejo-admin`, field `API_TOKEN`
-- [ ] Positive fetch after OIDC login
+      (initial provision used field `Token`; re-stored as `API_TOKEN` 2026-07-13 to
+      match CCR/catalog/playbook `fetch_command`)
+- [x] Positive fetch verified 2026-07-13 — `bao kv get -field=API_TOKEN …` returns
+      non-empty; PAT valid against `forgejo.coulomb.social` (`/api/v1/user` →
+      `login=tegwick`, `is_admin=true`)
 - [x] Negative default-policy denial recorded on CCR
-- [ ] Promote catalog to `active` after positive verify
+- [x] Promoted catalog `forgejo-admin-api-token` to `active` (`resolvable: true`)
 
 ### T5 — Notify downstream consumers