Catalog fluid-telegram-operator (draft) and tenant-engine sender projection; case plan env spec and case-ref

- fluid-telegram-operator: pointer-only draft entry and playbook from ops-mason's
  MASON-WP-0005-T06 proposal; activation waits for the owner-run member and
  non-member checks and the salt create-once probe.
- audit-core-senders: tenant-engine recorded as a verified exact-path consumer
  projection (MASON-WP-0007-T06). The registry lane itself stays draft.
- warden case plan: {param:env} format spec (net-kingdom 850907a), other specs
  and conversions refused; prints case-ref <case_id>@sha256:<file digest>.
- Workload-join unknown count 21 -> 22 (test and pep-stance.yaml).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 427672@bnt-lap001
Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8

tests/test_workload_join.py

@@ -13,7 +13,7 @@ def test_repo_catalog_uses_only_explicit_workload_references():
     report = build(ROOT / "registry/routing/catalog.yaml", Path.home())
     assert report["ok"] is True
     assert len(report["resolved"]) == 4
-    assert len(report["unknown"]) == 21
+    assert len(report["unknown"]) == 22
     # 15 since 2026-09-21: the layer-declaration route is repository conformance
     # guidance, not a workload delivery lane, and the two NetKingdom SSO lanes
     # (c374d41) remain provider/control-plane credentials. Lanes added after
@@ -24,6 +24,8 @@ def test_repo_catalog_uses_only_explicit_workload_references():
     # under a founder-minted grant, not a workload credential. 17 since
     # 2026-10-08: platform-supplier-credentials (WARDEN-WP-0043) is a generic
     # supplier-account path pattern; concrete consumers keep their own lanes.
+    # unknown 22 since 2026-10-09: fluid-telegram-operator (MASON-WP-0005-T06)
+    # names fluid-telegram, which has published no workload declaration.
     assert len(report["not_applicable"]) == 17
     assert {row["lane"] for row in report["resolved"]} == {
         "ops-warden-warden-sign-token",