feat(routing): repoint whynot npm lane to Forgejo

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43

registry/routing/catalog.yaml

@@ -196,19 +196,19 @@ entries:
     lane: ceremony
 
   - id: whynot-design-npm-publish
-    title: whynot-design npm publish token (@whynot/design → coulomb Gitea registry)
+    title: whynot-design npm publish token (@whynot/design → coulomb Forgejo registry)
     # Publish rights to the package registry — a leaked token is a supply-chain write, not a read (WARDEN-WP-0032-T05).
     risk: high
     workload_ref:
       applicability: applicable
       unknown_reason: "whynot-design has not published an authoritative workload identity declaration."
-    need_keywords: [whynot-design, whynot, npm, publish, npm_auth_token, gitea, registry, coulomb, package]
+    need_keywords: [whynot-design, whynot, npm, publish, npm_auth_token, forgejo, registry, coulomb, package]
     owner_repo: railiance-platform
     subsystem: OpenBao
     warden_executes: false
     wiki_ref: wiki/playbooks/whynot-design-npm-publish.md#worker-checklist
     canon_ref: net-kingdom/docs/platform-identity-security-architecture.md
-    reviewed: "2026-06-29"
+    reviewed: "2026-09-04"
     status: active
     delegation:
       mode: native
@@ -238,9 +238,9 @@ entries:
       owner: railiance-platform
       automatable: false
       steps:
-        - "In the coulomb Gitea/Forgejo registry, revoke the current @whynot/design publish token and generate a new one (scope: package read/write) for the whynot-design publish identity."
+        - "In the coulomb Forgejo registry, revoke the current @whynot/design publish token and generate a new one (scope: package read/write) for the whynot-design publish identity."
         - "Write it back: `bao kv put platform/workloads/coulomb/whynot-design/npm-publish NPM_AUTH_TOKEN=@file` (value from a mode-0600 file)."
-        - "Verify capabilities-safe, then confirm publish works via `secrets-engine exec --catalog whynot-design-npm-publish -- npm whoami` (value used, not printed)."
+        - "Verify capabilities-safe, then publish a fresh version and confirm it with Forgejo-supported `npm view <package>@<version>` through the governed execution lane (value used, not printed)."
 
   - id: policy-nexus-forgejo-source-read
     title: Policy Nexus Forgejo private-source repository read token
@@ -325,8 +325,8 @@ entries:
     # point is to obtain one). warden runs it interactively as the caller and never
     # captures the resulting token — the owner tool writes it to the caller's store.
     lane: login
-    auth_method: "browser OIDC via key-cape / Keycloak"
-    fetch_command: "bao login -method=oidc role=<domain>"
+    auth_method: "browser OIDC via key-cape / Keycloak at auth/netkingdom"
+    fetch_command: "bao login -no-print -method=oidc -path=netkingdom role=<domain>"
     exec_capable: true
 
   - id: ops-bridge-tunnel