feat: route Policy Nexus source credential

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

registry/routing/catalog.yaml

@@ -242,6 +242,42 @@ entries:
         - "Write it back: `bao kv put platform/workloads/coulomb/whynot-design/npm-publish NPM_AUTH_TOKEN=@file` (value from a mode-0600 file)."
         - "Verify capabilities-safe, then confirm publish works via `secrets-engine exec --catalog whynot-design-npm-publish -- npm whoami` (value used, not printed)."
 
+  - id: policy-nexus-forgejo-source-read
+    title: Policy Nexus Forgejo private-source repository read token
+    # Read-only at Forgejo, but disclosure grants estate-wide private source access.
+    # Agent callers therefore remain inside Warden's sanctioned transport boundary.
+    risk: high
+    workload_ref:
+      applicability: applicable
+      unknown_reason: "policy-nexus-actions has not published an authoritative workload identity declaration."
+    need_keywords: [policy-nexus, policy, nexus, forgejo, private, source, repository, read, token, actions, FORGEJO_SOURCE_TOKEN]
+    owner_repo: railiance-platform
+    subsystem: OpenBao + Forgejo Actions
+    warden_executes: false
+    wiki_ref: wiki/playbooks/policy-nexus-forgejo-source-read.md#worker-checklist
+    canon_ref: railiance-platform/credential-change-requests/CCR-2026-0014-policy-nexus-forgejo-source-read.yaml
+    reviewed: "2026-09-01"
+    status: active
+    delegation:
+      mode: native
+      intended_owner: railiance-platform
+      reviewed: "2026-09-01"
+      verified: source-read
+    auth_method: "bao login -method=oidc -path=netkingdom role=policy-nexus-forgejo-source-workload-kv-read"
+    path_template: "platform/workloads/policy-nexus/forgejo-source-read"
+    fetch_command: "bao kv get -field=FORGEJO_SOURCE_TOKEN platform/workloads/policy-nexus/forgejo-source-read"
+    policy_ref: "flex-auth check secret.read:policy-nexus"
+    exec_capable: true
+    lane: secret
+    rotation:
+      method: rotate
+      owner: railiance-platform
+      automatable: false
+      steps:
+        - "Mint a replacement PAT for the restricted policy-nexus-source identity with scope exactly read:repository; retain the predecessor until verification passes."
+        - "Use the attended railiance-platform bootstrap to update OpenBao and the coulomb/policy-nexus FORGEJO_SOURCE_TOKEN Actions secret without exposing the value."
+        - "Pass one exact-commit candidate workflow, then revoke the predecessor PAT and record bounded non-secret evidence in CCR-2026-0014."
+
   - id: flex-auth-policy-check
     title: Authorization decision — may this actor perform this action
     # Returns an authorization decision; no credential flows (WARDEN-WP-0032-T05).