Register the State Hub Forgejo derivation-read routing lane.

Pointer-only catalog entry so warden route find "state hub read
private repository" resolves. ops-warden routes and does not execute.
MASON-WP-0003-T03.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

registry/routing/catalog.yaml

@@ -684,6 +684,37 @@ entries:
         - "Verify capabilities-safe on the data path (`bao token capabilities`); run a restore drill against a re-encrypted artifact."
         - "After rotation, clear EXPOSED taint: remove custom_metadata exposed_at/exposed_version (see `warden taint railiance-backup-offsite-lane`)."
 
+  - id: state-hub-forge-derivation-read
+    title: Forgejo read-only token for State Hub projection derivation
+    risk: high
+    workload_ref:
+      applicability: applicable
+      unknown_reason: "state-hub has not published an authoritative workload identity declaration; Kubernetes auth role state-hub-forge-derivation binds ServiceAccount state-hub/state-hub."
+    need_keywords: [state-hub, statehub, forge, forgejo, derivation, derive, projection, private, repository, clone, FORGE_READ_TOKEN, ADR-012, work-records, unreadable, kubernetes-auth]
+    owner_repo: ops-mason
+    subsystem: OpenBao + Forgejo
+    warden_executes: false
+    wiki_ref: wiki/playbooks/state-hub-forge-derivation-read.md#worker-checklist
+    canon_ref: ops-mason/plans/state-hub-forge-derivation-read.md
+    reviewed: "2026-09-14"
+    status: active
+    delegation:
+      mode: native
+      intended_owner: ops-mason
+      reviewed: "2026-09-14"
+      verified: owner-confirmed
+    auth_method: "Kubernetes auth (role state-hub-forge-derivation, ServiceAccount state-hub/state-hub) from the in-cluster state-hub workload"
+    path_template: "platform/workloads/state-hub/forge-derivation (field FORGE_READ_TOKEN)"
+    rotation:
+      method: rotate
+      owner: ops-mason
+      automatable: false
+      steps:
+        - "Mint a replacement read-only token in Forgejo — repository read, organisation-wide, no other scope."
+        - "Deliver it to platform/workloads/state-hub/forge-derivation, field FORGE_READ_TOKEN, via paste_once_provision. ops-mason does not handle the value."
+        - "Revoke the previous token in Forgejo."
+        - "Confirm a derivation pass still reads a known private repository; rotation must not require a chart change or a redeploy."
+
   - id: forgejo-admin-api-token
     title: Forgejo operator/admin API token (PAT)
     need_keywords: [forgejo, admin, pat, package, prune, FORGEJO_ADMIN_TOKEN, forgejo-package-prune, forgejo-tegwick, webhook, forgejo-npm]