WARDEN-WP-0029: implement plan front door, org posture, desk, freshness

Ship posture-aware access planning: organization_posture=build (axis C),
catalog freshness warnings, warden plan verdicts, localhost founder desk,
and playbook/agent guidance that retire /tmp file-drop patterns.

Compose route catalog + handoff rather than a second routing layer.

src/warden/scorecard.py

@@ -189,6 +189,70 @@ def check_catalog_rotation_coverage() -> CheckResult:
     )
 
 
+def check_organization_posture() -> CheckResult:
+    """Surface declared organization lifecycle posture (WARDEN-WP-0029 T02).
+
+    Always informational PASS when descriptors load -- the check exists so operators
+    and agents see the posture in scorecard output without hunting config files.
+    """
+    try:
+        from warden.posture import load_posture
+
+        cat = load_posture()
+        org = cat.organization_posture
+    except Exception as e:  # noqa: BLE001
+        return CheckResult(
+            name="organization_posture",
+            passed=False,
+            detail=f"could not load organization posture: {e}",
+        )
+    relax = ", ".join(org.relaxations[:3])
+    if len(org.relaxations) > 3:
+        relax += ", ..."
+    summary = org.summary[:120]
+    if len(org.summary) > 120:
+        summary += "..."
+    relax_part = relax or "no relaxations listed"
+    return CheckResult(
+        name="organization_posture",
+        passed=True,
+        detail=f"{org.id} -- {summary} [{relax_part}]",
+    )
+
+
+def check_catalog_freshness() -> CheckResult:
+    """Warn when the CLI is using a bundled (stale-risk) catalog (WP-0029 T05)."""
+    try:
+        from warden.routing import load_catalog
+
+        fresh = load_catalog().freshness()
+    except Exception as e:  # noqa: BLE001
+        return CheckResult(
+            name="catalog_freshness",
+            passed=False,
+            detail=f"could not load routing catalog: {e}",
+        )
+    if fresh.using_bundled:
+        nwarn = len(fresh.warnings)
+        return CheckResult(
+            name="catalog_freshness",
+            passed=False,
+            detail=(
+                f"bundled catalog hash={fresh.content_hash} - reinstall from checkout "
+                f"if lanes look missing ({nwarn} warnings)"
+            ),
+        )
+    return CheckResult(
+        name="catalog_freshness",
+        passed=True,
+        detail=(
+            f"source={fresh.source} hash={fresh.content_hash} "
+            f"entries={fresh.active_count}/{fresh.entry_count} active "
+            f"newest_reviewed={fresh.newest_reviewed}"
+        ),
+    )
+
+
 def run_scorecard(state_dir: Path, inventory: PrincipalsInventory) -> List[CheckResult]:
     """Run all cert-side scorecard checks. Returns list of CheckResult."""
     return [
@@ -199,4 +263,6 @@ def run_scorecard(state_dir: Path, inventory: PrincipalsInventory) -> List[Check
         check_ttl_policy(state_dir, inventory),
         check_file_permissions(state_dir),
         check_catalog_rotation_coverage(),
+        check_organization_posture(),
+        check_catalog_freshness(),
     ]