WARDEN-WP-0029: implement plan front door, org posture, desk, freshness

Ship posture-aware access planning: organization_posture=build (axis C),
catalog freshness warnings, warden plan verdicts, localhost founder desk,
and playbook/agent guidance that retire /tmp file-drop patterns.

Compose route catalog + handoff rather than a second routing layer.

registry/policy/security-posture.yaml

@@ -71,3 +71,23 @@ dataclass_floor:
 lattice:
   requires_env_posture: prod
   rule: no-write-down
+
+# --- Axis C — organization lifecycle posture (WARDEN-WP-0029 T02) --------------
+# Third axis: fleet lifecycle, distinct from env (dev/test/prod) and maturity
+# (M0–M3). Answers how aggressive policy relaxations may be for founder-scale
+# operation. Graduate when any trigger fires; do not overload env/maturity.
+organization_posture:
+  id: build
+  summary: >
+    One founder-operator, pre-revenue, velocity prioritized. Pragmatic
+    provisioning is acceptable where audit and custody invariants hold
+    (values only in OpenBao/process env; metadata-only trails).
+  relaxations:
+    - workstation_oidc_acceptable
+    - per_repo_deploy_keys
+    - flex_auth_advisory_default
+    - localhost_founder_desk_os_session_trust
+  graduation_triggers:
+    - first_customer_data
+    - first_non_founder_operator
+    - production_tier

registry/routing/catalog.yaml

@@ -423,7 +423,7 @@ entries:
 
   - id: agent-harness-forgejo-deploy
     title: agent-harness Forgejo deploy key (write sandbox; binky-control at cutover)
-    need_keywords: [agent-harness, forgejo, deploy, key, ssh, executor-sandbox, railiance]
+    need_keywords: [agent-harness, forgejo, deploy, key, ssh, executor-sandbox, railiance, binky-control, deploy-key]
     owner_repo: railiance-platform
     subsystem: OpenBao + Forgejo + agent-harness
     warden_executes: false
@@ -439,7 +439,8 @@ entries:
     path_template: "platform/workloads/agent-harness/forgejo-deploy-key"
     fetch_command: "bao kv get -field=SSH_PUBLIC_KEY platform/workloads/agent-harness/forgejo-deploy-key"
     policy_ref: "flex-auth check secret.read:agent-harness-forgejo"
-    exec_capable: false
+    # Assist proxy for public key metadata field (private key stays host-local / high-risk).
+    exec_capable: true
     lane: secret
     rotation:
       method: re-establish