feat: route Policy Nexus source credential

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

tests/test_routing.py

@@ -153,6 +153,32 @@ def test_whynot_design_npm_lane_is_concrete_and_resolvable():
     assert "platform/workloads/coulomb/whynot-design/npm-publish" in e.fetch_command
 
 
+def test_policy_nexus_source_read_lane_is_exact_high_risk_and_resolvable():
+    catalog = load_catalog(_repo_catalog())
+    entry = catalog.get("policy-nexus-forgejo-source-read")
+    assert entry is not None and entry.is_active and entry.exec_capable
+    assert entry.resolvable is True
+    assert entry.risk == "high"
+    assert entry.owner_repo == "railiance-platform"
+    assert entry.fetch_command == (
+        "bao kv get -field=FORGEJO_SOURCE_TOKEN "
+        "platform/workloads/policy-nexus/forgejo-source-read"
+    )
+    assert entry.path_template == "platform/workloads/policy-nexus/forgejo-source-read"
+    assert entry.auth_method.endswith(
+        "role=policy-nexus-forgejo-source-workload-kv-read"
+    )
+    assert entry.delegation is not None and entry.delegation.mode == "native"
+
+
+def test_route_find_policy_nexus_source_read_prefers_concrete_lane():
+    catalog = load_catalog(_repo_catalog())
+    matches = catalog.find(
+        "policy nexus Forgejo private source repository read token Actions", limit=1
+    )
+    assert matches[0].id == "policy-nexus-forgejo-source-read"
+
+
 def test_generic_and_template_lanes_not_resolvable():
     catalog = load_catalog(_repo_catalog())
     # generic openbao lane has <FIELD>/<path_template>; login lane has <domain>.

tests/test_workload_join.py

@@ -13,7 +13,7 @@ def test_repo_catalog_uses_only_explicit_workload_references():
     report = build(ROOT / "registry/routing/catalog.yaml", Path.home())
     assert report["ok"] is True
     assert len(report["resolved"]) == 3
-    assert len(report["unknown"]) == 17
+    assert len(report["unknown"]) == 18
     # 11 since WARDEN-WP-0033: the two NetKingdom SSO lanes (c374d41) are
     # provider/control-plane credentials, not workload delivery lanes.
     assert len(report["not_applicable"]) == 11