WARDEN-WP-0029: implement plan front door, org posture, desk, freshness

Ship posture-aware access planning: organization_posture=build (axis C),
catalog freshness warnings, warden plan verdicts, localhost founder desk,
and playbook/agent guidance that retire /tmp file-drop patterns.

Compose route catalog + handoff rather than a second routing layer.

AGENTS.md

@@ -119,18 +119,33 @@ other credential need belongs to another subsystem. **Do not** message
 
 ### Lookup (do this first)
 
+**Always plan before drafting any founder credential step** (WARDEN-WP-0029):
+
+```bash
+warden plan "<describe your need>" --json
+# verdict: autonomous | founder_required | unroutable
+# autonomous → run the commands (usually warden access --exec/--out/--wrap)
+# founder_required → escalate exactly one act via warden desk (not /tmp file drops)
+# unroutable → propose a CCR / catalog lane; do not improvise
+```
+
+Supporting lookups:
+
 ```bash
 warden route find "<describe your need>" --json
 warden route show <catalog-id> --json
+warden route list   # human output includes catalog source/hash freshness
 ```
 
 Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run warden`).
+If `warden plan` misses a known lane, the installed catalog may be stale (bundled
+fallback) — reinstall from checkout and re-run plan.
 
 | Agent runtime | How to orient |
 | --- | --- |
-| **Codex / Grok** (shell, HTTP State Hub) | `warden route` commands above; inbox `to_agent=ops-warden` is for coordination, not secret vending |
-| **Claude Code** (MCP when available) | `get_domain_summary("custodian")` for workplans; **still** use `warden route` for credential ownership |
-| **llm-connect** (inference service) | Never put secret retrieval in prompts; route custody to OpenBao/operator paths surfaced by `warden route` |
+| **Codex / Grok** (shell, HTTP State Hub) | `warden plan` first; inbox `to_agent=ops-warden` is for coordination, not secret vending |
+| **Claude Code** (MCP when available) | `get_domain_summary("custodian")` for workplans; **still** use `warden plan` / `warden route` for credential ownership |
+| **llm-connect** (inference service) | Never put secret retrieval in prompts; route custody to OpenBao/operator paths surfaced by `warden plan` |
 
 ### Quick routing table
 
@@ -145,11 +160,15 @@ Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run wa
 
 ### Anti-patterns (do not do these)
 
+- Drafting founder steps ("paste PAT to `/tmp`", "click Forgejo admin UI") **without**
+  `warden plan` first (WP-0029)
 - `POST /messages/` to `ops-warden` asking for `ISSUE_CORE_API_KEY`, `OPENROUTER_API_KEY`, etc.
 - Inventing `warden secret`, `warden login`, `warden bao`, `warden tunnel` — they do not exist
 - Pasting secrets into Git, State Hub, workplans, logs, or chat
 - **Reading a secret value onto a captured stdout.** Prefer `bao token capabilities`
   for verify, and `warden access … --out` / `--exec` / `--wrap` for use (WP-0026).
+- Steady-state credential **file drops** (`/tmp/…-token`); use desk paste-once or
+  sanctioned transports instead
 
 ### Agent read-boundary + EXPOSED taint (WP-0026 T04/T05)