feat(routing): repoint whynot npm lane to Forgejo

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43

workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md

@@ -0,0 +1,79 @@
+---
+id: WARDEN-WP-0037
+type: workplan
+title: "Repoint the whynot-design npm lane to Forgejo"
+domain: infotech
+repo: ops-warden
+status: active
+owner: codex
+topic_slug: whynot-design-forgejo-npm-lane
+created: "2026-09-04"
+updated: "2026-09-04"
+state_hub_workstream_id: "42a097db-1c24-558e-a724-030bb2b4443e"
+---
+
+## Verify the existing credential against Forgejo
+
+```task
+id: WARDEN-WP-0037-T01
+status: done
+priority: high
+state_hub_task_id: "afc4d325-1c6d-5c25-aaf7-2118aa8f86c6"
+```
+
+Use only the governed execution transport to test the existing publish identity
+against the canonical Forgejo npm endpoint. Do not print or persist the token.
+
+2026-09-04: `warden plan` classified the exact verification as autonomous and
+selected this lane. A contained login using the documented
+`whynot-design-workload-kv-read` role proved `read` on the exact OpenBao data
+path, and the governed child proved the secret is present. A real 0.4.2 publish
+through that credential then failed. No value was printed or persisted and each
+contained session self-revoked. The lane therefore needs token rotation, not an
+OpenBao policy repair.
+
+## Repoint the catalog and playbook
+
+```task
+id: WARDEN-WP-0037-T02
+status: done
+priority: high
+state_hub_task_id: "7ceb2f74-496c-54e8-bf5a-3c49f994ff23"
+```
+
+Replace the retired Gitea endpoint and discovery language with Forgejo while
+preserving the established OpenBao path, field, and least-privilege boundary.
+This delivers the npm facet of routed intake
+`01a06e07-f2f9-7586-9745-b359eb0025b6`; its inter-hub SSH facet remains separate.
+
+Completed 2026-09-04. The catalog title, discovery keywords, rotation guidance,
+and worker playbook now name the canonical Forgejo registry at
+`https://forgejo.coulomb.social/api/packages/coulomb/npm/`. The OpenBao path,
+field, owner, native-exec pointer, and high-risk boundary are unchanged. A
+regression assertion prevents the retired Gitea discovery term and guidance
+from returning.
+
+## Prove routing and publication
+
+```task
+id: WARDEN-WP-0037-T03
+status: wait
+priority: high
+state_hub_task_id: "a8b1b855-ab34-5835-b9fd-5f48bc0b6817"
+```
+
+Pass catalog and routing tests, verify the checkout route, and record the exact
+Forgejo package release proven through the lane.
+
+2026-09-04: repo-local verification is complete: the checkout route ranks
+`whynot-design-npm-publish` first for a Forgejo npm publish need, reports the
+canonical Forgejo title and verification command, all focused
+routing/access/proxy tests pass (`145 passed`).
+
+The sibling repo's `@whynot/design@0.4.2` release (105 files; IR
+`designVersion` 0.4.2; five visual tests pass) was published through the
+plan-authorized `forgejo-admin-api-token` one-time recovery lane. An
+authenticated exact-version lookup proved that Forgejo's remote integrity
+matches the local dry-run. T03 waits only on rotating the dedicated package
+token and proving the next fresh version through `whynot-design-npm-publish`;
+the package migration itself is complete.