WARDEN-WP-0029: implement plan front door, org posture, desk, freshness

Ship posture-aware access planning: organization_posture=build (axis C),
catalog freshness warnings, warden plan verdicts, localhost founder desk,
and playbook/agent guidance that retire /tmp file-drop patterns.

Compose route catalog + handoff rather than a second routing layer.

registry/policy/security-posture.yaml

@@ -71,3 +71,23 @@ dataclass_floor:
 lattice:
   requires_env_posture: prod
   rule: no-write-down
+
+# --- Axis C — organization lifecycle posture (WARDEN-WP-0029 T02) --------------
+# Third axis: fleet lifecycle, distinct from env (dev/test/prod) and maturity
+# (M0–M3). Answers how aggressive policy relaxations may be for founder-scale
+# operation. Graduate when any trigger fires; do not overload env/maturity.
+organization_posture:
+  id: build
+  summary: >
+    One founder-operator, pre-revenue, velocity prioritized. Pragmatic
+    provisioning is acceptable where audit and custody invariants hold
+    (values only in OpenBao/process env; metadata-only trails).
+  relaxations:
+    - workstation_oidc_acceptable
+    - per_repo_deploy_keys
+    - flex_auth_advisory_default
+    - localhost_founder_desk_os_session_trust
+  graduation_triggers:
+    - first_customer_data
+    - first_non_founder_operator
+    - production_tier