Add draft routing entry audit-core-senders

Pointer-only. Database leases stay on database-dynamic-credentials.
Promote after the Mason AppRole build is verified.

registry/routing/catalog.yaml

@@ -640,6 +640,23 @@ entries:
         - "USER_ENGINE_PROXY_SECRET: rotate user-engine/user-engine-runtime, re-run make coulomb-social-env-secret, restart app."
         - "DATABASE_URL: platform rotates apps-pg role password secret; re-run make coulomb-social-env-secret; restart app."
 
+  - id: audit-core-senders
+    title: audit-core sender registry (write and operator-read tokens)
+    need_keywords: [audit-core, senders, sender registry, ingest token, AUDIT_CORE_SENDERS]
+    owner_repo: ops-mason
+    subsystem: OpenBao + audit-core
+    warden_executes: false
+    wiki_ref: wiki/playbooks/audit-core-senders.md#worker-checklist
+    canon_ref: audit-core/docs/operator-runbook.md
+    reviewed: "2026-08-13"
+    status: draft
+    auth_method: "in-cluster generated Secret audit-core-senders; later OpenBao KV via Mason wrap-migrate"
+    path_template: "platform/workloads/audit-core/senders"
+    policy_ref: "external-secrets-audit-core"
+    exec_capable: false
+    resolvable: false
+    lane: secret
+
   - id: email-connect-transactional
     title: email-connect transactional SMTP and caller ingest token
     need_keywords: [email-connect, transactional, smtp, ionos, starttls, ingest, invitation, verification, EMAIL_CONNECT_SMTP_PASSWORD, EMAIL_CONNECT_INGEST_TOKEN]