WARDEN-WP-0029: implement plan front door, org posture, desk, freshness

Ship posture-aware access planning: organization_posture=build (axis C),
catalog freshness warnings, warden plan verdicts, localhost founder desk,
and playbook/agent guidance that retire /tmp file-drop patterns.

Compose route catalog + handoff rather than a second routing layer.

registry/routing/catalog.yaml

@@ -423,7 +423,7 @@ entries:
 
   - id: agent-harness-forgejo-deploy
     title: agent-harness Forgejo deploy key (write sandbox; binky-control at cutover)
-    need_keywords: [agent-harness, forgejo, deploy, key, ssh, executor-sandbox, railiance]
+    need_keywords: [agent-harness, forgejo, deploy, key, ssh, executor-sandbox, railiance, binky-control, deploy-key]
     owner_repo: railiance-platform
     subsystem: OpenBao + Forgejo + agent-harness
     warden_executes: false
@@ -439,7 +439,8 @@ entries:
     path_template: "platform/workloads/agent-harness/forgejo-deploy-key"
     fetch_command: "bao kv get -field=SSH_PUBLIC_KEY platform/workloads/agent-harness/forgejo-deploy-key"
     policy_ref: "flex-auth check secret.read:agent-harness-forgejo"
-    exec_capable: false
+    # Assist proxy for public key metadata field (private key stays host-local / high-risk).
+    exec_capable: true
     lane: secret
     rotation:
       method: re-establish