chore(registry): regenerate high-risk data paths

Picks up state-hub-forge-derivation-read, and two lanes added on
2026-08-23 that were never regenerated after
(net-kingdom-lldap-bind-credential, net-kingdom-privacyidea-admin-token).
21 -> 24.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166

registry/generated/high-risk-data-paths.yaml

@@ -10,12 +10,12 @@
 # declares it, and is null where the field set has not been established --
 # null means unknown, never 'one field'.
 
-generated_at: "2026-08-22T23:31:10Z"
+generated_at: "2026-08-26T19:56:48Z"
 source: ops-warden/registry/routing/catalog.yaml
-catalog_revision: "0fae0904ce8d8694338dd53a8a79abec5fec788d"
-catalog_revision_date: "2026-08-23T01:31:05+02:00"
+catalog_revision: "3a4333d850295d2bed39136bfe53f786564eec03"
+catalog_revision_date: "2026-08-26T21:56:44+02:00"
 catalog_dirty: false
-high_risk_lane_count: 21
+high_risk_lane_count: 24
 concrete_path_count: 14
 
 # Graded high but not a single KV address -- a routing pattern, a broker
@@ -23,11 +23,14 @@ concrete_path_count: 14
 no_concrete_path:
   - database-dynamic-credentials
   - inter-hub-bootstrap-ssh
+  - net-kingdom-lldap-bind-credential
+  - net-kingdom-privacyidea-admin-token
   - object-storage-sts
   - openbao-api-key
   - openbao-platform-admin-login
   - openbao-shamir-recovery-ceremony
   - ops-warden-warden-sign-token
+  - state-hub-forge-derivation-read
 
 paths:
   - id: agent-harness-binky-mail-approle