catalog: draft scaleway-bootstrap lane

Pointer to the mason plan and playbook. Founder provision only;
warden does not execute the fetch.

registry/routing/catalog.yaml

@@ -692,3 +692,31 @@ entries:
         - "`bao kv put platform/workloads/email-connect/transactional EMAIL_CONNECT_SMTP_PASSWORD=@file` (and USERNAME/INGEST_TOKEN if those rotate); shred mode-0600 files."
         - "ESO re-syncs email-connect/email-connect-runtime; roll email-connect. If INGEST_TOKEN changed, update user-engine runtime and roll user-engine."
         - "Verify capabilities-safe on platform/data/workloads/email-connect/transactional; confirm /healthz Ready without printing secret values."
+
+  - id: scaleway-bootstrap
+    title: Scaleway org/project API key for reef-storage bucket create
+    need_keywords: [scaleway, s3, object-storage, bootstrap, reef-storage, backup, nl-ams]
+    owner_repo: railiance-platform
+    subsystem: OpenBao + Scaleway
+    warden_executes: false
+    wiki_ref: wiki/playbooks/scaleway-bootstrap.md#worker-checklist
+    canon_ref: ops-mason/plans/reef-storage-scaleway-bootstrap.md
+    reviewed: "2026-08-14"
+    status: draft
+    risk: high
+    # CCR-2026-0011. Values via founder paste-once or local tfvars ingest.
+    # Not the Barman runtime key (platform-pg-backup-s3).
+    auth_method: "caller's own OpenBao token (founder / operator workstation)"
+    path_template: "platform/workloads/railiance/scaleway/bootstrap"
+    fetch_command: "bao kv metadata get platform/workloads/railiance/scaleway/bootstrap"
+    exec_capable: false
+    resolvable: false
+    lane: secret
+    rotation:
+      method: rotate
+      owner: railiance-platform
+      automatable: false
+      steps:
+        - "In Scaleway IAM, revoke the bootstrap API key after the scoped bucket key exists."
+        - "Delete or overwrite platform/workloads/railiance/scaleway/bootstrap; do not copy values into chat."
+        - "Confirm metadata gone or version bumped; capabilities-safe only."