Catalog fluid-telegram-operator (draft) and tenant-engine sender projection; case plan env spec and case-ref

- fluid-telegram-operator: pointer-only draft entry and playbook from ops-mason's
  MASON-WP-0005-T06 proposal; activation waits for the owner-run member and
  non-member checks and the salt create-once probe.
- audit-core-senders: tenant-engine recorded as a verified exact-path consumer
  projection (MASON-WP-0007-T06). The registry lane itself stays draft.
- warden case plan: {param:env} format spec (net-kingdom 850907a), other specs
  and conversions refused; prints case-ref <case_id>@sha256:<file digest>.
- Workload-join unknown count 21 -> 22 (test and pep-stance.yaml).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 427672@bnt-lap001
Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8

tests/test_case_plan.py

@@ -34,7 +34,8 @@ TYPE = {
             {"id": "mint", "owner": "o", "entry_point": "mint {client_id}", "auth": "caller",
              "lane": "key-cape-oidc-login", "warden_executes": True, "attended": False,
              "value_handling": "generated_in_custody", "when": "client_type == confidential"},
-            {"id": "login", "owner": "o", "entry_point": "apply {client_id}", "auth": "operator",
+            {"id": "login", "owner": "o", "entry_point": "apply {client_id} env KEYCAPE_{client_id:env}_X",
+             "auth": "operator",
              "lane": "key-cape-oidc-login", "warden_executes": False, "attended": True,
              "value_handling": "none", "attended_justification": "live registry is a Secret"},
             {"id": "handover", "owner": "{consumer}", "entry_point": "use {issuer}", "auth": "a",
@@ -158,6 +159,21 @@ def test_refuse_secret_parameter(catalog):
         plan_case(_case(parameters=dict(CASE["spec"]["parameters"], pw="hunter2")), doc, catalog)
 
 
+def test_env_format_spec_renders_like_keycape_client(catalog):
+    params = dict(CASE["spec"]["parameters"], client_id="my-app")
+    plan = plan_case(_case(parameters=params), _type(), catalog)
+    login = next(s for s in plan.steps if s.id == "login")
+    assert login.entry_point == "apply my-app env KEYCAPE_MY_APP_X"
+
+
+@pytest.mark.parametrize("template", ["{client_id:upper}", "{client_id:>9}", "{client_id!r}"])
+def test_refuse_unknown_format_spec_or_conversion(catalog, template):
+    doc = _type()
+    doc["spec"]["follow_through"][0]["entry_point"] = template
+    with pytest.raises(CaseError, match="format spec|conversions"):
+        plan_case(_case(), doc, catalog)
+
+
 def test_refuse_unsupported_condition(catalog):
     doc = _type()
     doc["spec"]["follow_through"][0]["when"] = "client_type in (a, b)"
@@ -173,6 +189,9 @@ def test_cli_plan_shows_attended_and_exit_codes(tmp_path):
     ok = runner.invoke(app, ["case", "plan", str(case_file), "--type", str(type_file)])
     assert ok.exit_code == 0, ok.output
     assert "ATTENDED" in ok.output and "nothing executed" in ok.output
+    import hashlib
+    digest = hashlib.sha256(case_file.read_bytes()).hexdigest()
+    assert f"case-ref: c@sha256:{digest}" in ok.output
     case_file.write_text(yaml.safe_dump(_case(status="accepted")))
     refused = runner.invoke(app, ["case", "plan", str(case_file), "--type", str(type_file)])
     assert refused.exit_code == 1