Register the State Hub Forgejo derivation-read routing lane.

Pointer-only catalog entry so warden route find "state hub read
private repository" resolves. ops-warden routes and does not execute.
MASON-WP-0003-T03.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

registry/generated/high-risk-data-paths.yaml

@@ -10,12 +10,12 @@
 # declares it, and is null where the field set has not been established --
 # null means unknown, never 'one field'.
 
-generated_at: "2026-09-10T05:54:39Z"
+generated_at: "2026-09-14T02:57:04Z"
 source: ops-warden/registry/routing/catalog.yaml
-catalog_revision: "406446f7bb38efadf85849756c067a124902a2ec"
-catalog_revision_date: "2026-09-10T07:54:39+02:00"
-catalog_dirty: false
-high_risk_lane_count: 24
+catalog_revision: "73e40af6ca27ca547eb42782d2ceb1a5cc8c3534"
+catalog_revision_date: "2026-09-14T02:47:32+02:00"
+catalog_dirty: true
+high_risk_lane_count: 27
 concrete_path_count: 15
 
 # Graded high but not a single KV address -- a routing pattern, a broker
@@ -30,6 +30,9 @@ no_concrete_path:
   - openbao-platform-admin-login
   - openbao-shamir-recovery-ceremony
   - ops-warden-warden-sign-token
+  - secrets-engine-approval-client-login
+  - secrets-engine-requester-login
+  - state-hub-forge-derivation-read
 
 paths:
   - id: agent-harness-binky-mail-approle