WARDEN-WP-0029: implement plan front door, org posture, desk, freshness

Ship posture-aware access planning: organization_posture=build (axis C),
catalog freshness warnings, warden plan verdicts, localhost founder desk,
and playbook/agent guidance that retire /tmp file-drop patterns.

Compose route catalog + handoff rather than a second routing layer.

tests/test_posture.py

@@ -27,6 +27,9 @@ def test_real_descriptors_load():
     assert c.requires_env_posture == "prod"
     # YAML `on` gotcha must not have become a boolean
     assert c.env("test").audit == "on"
+    # WARDEN-WP-0029 third axis
+    assert c.organization_posture.id == "build"
+    assert "workstation_oidc_acceptable" in c.organization_posture.relaxations
 
 
 # --- the secret-flow lattice -----------------------------------------------
@@ -92,6 +95,12 @@ def _valid_data() -> dict:
         ],
         "dataclass_floor": {"synthetic": "M0", "internal": "M1"},
         "lattice": {"requires_env_posture": "prod", "rule": "no-write-down"},
+        "organization_posture": {
+            "id": "build",
+            "summary": "test build posture",
+            "relaxations": ["workstation_oidc_acceptable"],
+            "graduation_triggers": ["first_customer_data"],
+        },
     }
 
 
@@ -136,6 +145,16 @@ def test_cli_policy_list_json(monkeypatch):
     payload = json.loads(r.stdout)
     assert payload["requires_env_posture"] == "prod"
     assert len(payload["maturity_levels"]) == 4
+    assert payload["organization_posture"]["id"] == "build"
+
+
+def test_cli_policy_show_organization(monkeypatch):
+    monkeypatch.setenv("WARDEN_POSTURE_CATALOG", str(_repo_posture()))
+    r = runner.invoke(app, ["policy", "show", "build", "--json"])
+    assert r.exit_code == 0
+    payload = json.loads(r.stdout)
+    assert payload["axis"] == "organization_posture"
+    assert payload["id"] == "build"
 
 
 def test_cli_policy_show_unknown_exits_1(monkeypatch):