feat(catalog): agent-harness forgejo deploy + binky mail AppRole lanes

Register agent-harness-forgejo-deploy and agent-harness-binky-mail-approle
with playbook pointers; provisioned 2026-07-17 (metadata only).

registry/routing/catalog.yaml

@@ -421,6 +421,65 @@ entries:
         - "Re-run email-connect read-only scan with warden access --exec / env inject; confirm metadata-only evidence under binky-control/mailmeta/."
         - "Verify capabilities-safe on tenants/data/binky/company-email/imap; if EXPOSED taint was set, clear custom_metadata after rotation."
 
+  - id: agent-harness-forgejo-deploy
+    title: agent-harness Forgejo deploy key (write sandbox; binky-control at cutover)
+    need_keywords: [agent-harness, forgejo, deploy, key, ssh, executor-sandbox, railiance]
+    owner_repo: railiance-platform
+    subsystem: OpenBao + Forgejo + agent-harness
+    warden_executes: false
+    wiki_ref: wiki/playbooks/agent-harness-secrets.md#lane-2-forgejo-deploy-key
+    canon_ref: binky-control/integrations/executor-worker-secrets.md
+    reviewed: "2026-07-17"
+    status: active
+    risk: high
+    # Provisioned 2026-07-17 on railiance01: ed25519 keypair on host, OpenBao copy at
+    # platform/workloads/agent-harness/forgejo-deploy-key, write deploy key on
+    # coulomb/executor-sandbox (title agent-harness-railiance01). Git push verified.
+    auth_method: "caller's own OpenBao token (policy workload-kv-read-agent-harness-forgejo) or host-local key at ~/.local/agent-harness/ssh/forgejo-deploy"
+    path_template: "platform/workloads/agent-harness/forgejo-deploy-key"
+    fetch_command: "bao kv get -field=SSH_PUBLIC_KEY platform/workloads/agent-harness/forgejo-deploy-key"
+    policy_ref: "flex-auth check secret.read:agent-harness-forgejo"
+    exec_capable: false
+    lane: secret
+    rotation:
+      method: re-establish
+      owner: railiance-platform
+      automatable: false
+      steps:
+        - "On railiance01 generate a new ed25519 keypair under ~/.local/agent-harness/ssh/ (mode 600); do not paste the private key into chat or Git."
+        - "`bao kv put platform/workloads/agent-harness/forgejo-deploy-key SSH_PRIVATE_KEY=@file SSH_PUBLIC_KEY=@file` then register the public key as a write deploy key on coulomb/executor-sandbox (and binky-control at cutover); remove the old deploy key."
+        - "Verify `ssh -p 30022 -i <key> -T git@forgejo.coulomb.social` authenticates as the deploy key; test push to executor-sandbox only."
+
+  - id: agent-harness-binky-mail-approle
+    title: agent-harness AppRole for non-interactive Binky company-email IMAP read
+    need_keywords: [agent-harness, approle, binky, mail, imap, EXECUTOR_APPROLE_DIR, unattended]
+    owner_repo: railiance-platform
+    subsystem: OpenBao AppRole + agent-harness + email-connect
+    warden_executes: false
+    wiki_ref: wiki/playbooks/agent-harness-secrets.md#lane-3-mail-approle
+    canon_ref: binky-control/integrations/executor-worker-secrets.md
+    reviewed: "2026-07-17"
+    status: active
+    risk: high
+    # Provisioned 2026-07-17: role agent-harness-binky-mail bound to existing policy
+    # workload-kv-read-binky-company-email-imap; role_id/secret_id delivered to
+    # railiance01 ~/.local/agent-harness/approle-binky-mail (0600). Positive IMAP field
+    # lengths verified; negative forgejo-admin deny verified. token_ttl=15m max=30m
+    # token_num_uses=8. Human OIDC role unchanged.
+    auth_method: "AppRole login role=agent-harness-binky-mail (role_id+secret_id on worker host via EXECUTOR_APPROLE_DIR)"
+    path_template: "tenants/binky/company-email/imap"
+    fetch_command: "bao write -field=token auth/approle/login role_id=$ROLE_ID secret_id=$SECRET_ID  # then bao kv get -field=IMAP_PASSWORD tenants/binky/company-email/imap"
+    exec_capable: false
+    lane: secret
+    rotation:
+      method: rotate
+      owner: railiance-platform
+      automatable: false
+      steps:
+        - "bao write -f auth/approle/role/agent-harness-binky-mail/secret-id → new secret_id; deliver mode-0600 to railiance01 EXECUTOR_APPROLE_DIR; shred old secret_id file."
+        - "Optionally re-mint IMAP password (see binky-company-email-imap) if the mailbox credential itself rotated."
+        - "Verify AppRole login + field presence (lengths only); confirm default/other policies still deny sibling paths."
+
   # --- draft: owner path not yet shipped; hidden from default lookup ---
 
   - id: object-storage-sts