feat: adopt security zones and explicit workload refs

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

tests/test_workload_join.py

@@ -0,0 +1,52 @@
+"""Explicit lane-to-workload join tests (WARDEN-WP-0032 / RMGR-WP-0010-T06)."""
+from pathlib import Path
+
+import yaml
+
+from scripts.report_workload_join import build
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_repo_catalog_uses_only_explicit_workload_references():
+    report = build(ROOT / "registry/routing/catalog.yaml", Path.home())
+    assert report["ok"] is True
+    assert len(report["resolved"]) == 3
+    assert len(report["unknown"]) == 17
+    assert len(report["not_applicable"]) == 7
+    assert {row["lane"] for row in report["resolved"]} == {
+        "ops-warden-warden-sign-token",
+        "issue-core-ingestion-api-key",
+        "rapp-qonto-keycape-client",
+    }
+
+
+def test_invalid_exact_deployable_resolves_unknown(tmp_path):
+    rapp = tmp_path / "rapp-x" / "declarations"
+    rapp.mkdir(parents=True)
+    (rapp / "rapp.yaml").write_text(yaml.safe_dump({
+        "rapp_id": "rapp-x",
+        "workload_identity": {"name": "x"},
+        "composition": {"member_repos": [{"deployables": ["api"]}]},
+    }))
+    catalog_dir = tmp_path / "ops-warden" / "registry" / "routing"
+    catalog_dir.mkdir(parents=True)
+    catalog = catalog_dir / "catalog.yaml"
+    catalog.write_text(yaml.safe_dump({"entries": [{
+        "id": "x",
+        "workload_ref": {
+            "applicability": "applicable",
+            "rapp_id": "rapp-x",
+            "name": "x",
+            "deployable": "missing",
+        },
+    }]}))
+    posture = catalog_dir.parent / "policy"
+    posture.mkdir()
+    (posture / "security-posture.yaml").write_text("dataclass_floor: {}\n")
+
+    report = build(catalog, tmp_path)
+    assert not report["resolved"]
+    assert report["unknown"][0]["lane"] == "x"
+    assert "deployable" in report["unknown"][0]["reason"]