Catalog fluid-telegram-operator (draft) and tenant-engine sender projection; case plan env spec and case-ref

- fluid-telegram-operator: pointer-only draft entry and playbook from ops-mason's
  MASON-WP-0005-T06 proposal; activation waits for the owner-run member and
  non-member checks and the salt create-once probe.
- audit-core-senders: tenant-engine recorded as a verified exact-path consumer
  projection (MASON-WP-0007-T06). The registry lane itself stays draft.
- warden case plan: {param:env} format spec (net-kingdom 850907a), other specs
  and conversions refused; prints case-ref <case_id>@sha256:<file digest>.
- Workload-join unknown count 21 -> 22 (test and pep-stance.yaml).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 427672@bnt-lap001
Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8

workplans/WARDEN-WP-0044-security-case-follow-through.md

@@ -108,7 +108,7 @@ Tests: refuse an unaccepted or unmaterialized case; refuse a step whose catalog
 entry is missing or not reviewed; show attended steps explicitly.
 
 2026-10-09: done. `warden case plan <case.yaml> [--type] [--json]`
-(`src/warden/case_plan.py`, 15 tests in `tests/test_case_plan.py`). It refuses:
+(`src/warden/case_plan.py`, 14 tests in `tests/test_case_plan.py`). It refuses:
 - a case that is not `materialized`, or has no acceptance record
 - a type that is mismatched or not acknowledged
 - any `case check-type` finding, including a missing or unreviewed lane
@@ -130,6 +130,16 @@ Observation for net-kingdom (not blocking): `bind-env` runs before
 `KEYCAPE_<CLIENT_ID>_CLIENT_SECRET`, which is not a `{param}` placeholder, so it
 reaches the plan unrendered.
 
+2026-10-09 follow-up:
+- **Format specs.** `_render` supports net-kingdom's `{param:env}` spec (upper
+  case, `-` as `_`, the same as `keycape-client.py env_name`) and refuses any
+  other spec or `!conversion`.
+- **Case reference.** The plan prints `case-ref: <case_id>@sha256:<hex>` over the
+  case file's exact bytes. This is the reference proposed to railiance-platform
+  for `credential.py generate --case-ref` (RPF-WP-0054-T01); the broker
+  re-derives it from the file.
+- 18 tests now.
+
 ```task
 id: WARDEN-WP-0044-T03
 status: wait