feat(case): attended-change lane kind with session_lane; grade apps-consumer-handover high

LANE-KIND accepts an attended step on a login lane, or on an attended-change
lane whose session_lane resolves to an active, reviewed login lane.
keycape-attended-case-change -> session_lane key-cape-oidc-login (OW-1.3-C1).
consumer-owner-deployment and apps-consumer-handover -> pending-owner-confirmation:
no catalog login lane authenticates a railiance-apps operator session.
apps-consumer-handover risk: high (KERNEL-2, change effect).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23

registry/routing/catalog.yaml

@@ -1615,6 +1615,8 @@ entries:
     # for kernel-dispatched KeyCape registry, group and Deployment env changes.
     # The session may be established by a key-cape OIDC login; that login lane
     # stays the identity step, not the change authority.
+    lane: attended-change
+    session_lane: key-cape-oidc-login
     risk: high
     workload_ref:
       applicability: not-applicable
@@ -1656,6 +1658,8 @@ entries:
     # Descriptor actor is agent: ADR-0004 read boundary applies. Owner-side
     # delivery only; no raw value reaches the agent session. If that cannot be
     # shown, the actor changes to human and the railiance-apps digest changes.
+    lane: attended-change
+    session_lane: pending-owner-confirmation
     risk: high
     workload_ref:
       applicability: not-applicable
@@ -1674,7 +1678,9 @@ entries:
       reviewed: "2026-10-17"
   - id: apps-consumer-handover
     title: SecurityCase hand-over to the consuming service owner
-    risk: standard
+    lane: attended-change
+    session_lane: pending-owner-confirmation
+    risk: high
     workload_ref:
       applicability: not-applicable
       reason: "Per-case hand-over; the consumer owner is a case parameter."