fix: route OpenBao platform administration login

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836

registry/routing/catalog.yaml

@@ -144,6 +144,33 @@ entries:
         - "For dynamic-lease secrets, revoke the old lease (`bao lease revoke`) instead of a KV put."
         - "Verify capabilities-safe (`bao token capabilities` on the data path); notify consumers to re-fetch."
 
+  - id: openbao-platform-admin-login
+    title: Attended OpenBao platform administration login
+    # This is an identity bootstrap, not a secret value lane. The authority it
+    # establishes is high-risk, but the command prints no token and writes only
+    # to the caller's normal OpenBao token helper.
+    risk: high
+    workload_ref:
+      applicability: not-applicable
+      reason: "Attended human operator identity act; the governed admin operation supplies its own resource identity."
+    need_keywords: [openbao, platform-admin, platform, admin, administrator, first-time, bootstrap, database-engine, database/config, policy, policies, token-role, token-roles, mount, auth-role]
+    owner_repo: railiance-platform
+    subsystem: OpenBao operator OIDC via key-cape
+    warden_executes: false
+    wiki_ref: wiki/playbooks/openbao-platform-admin-login.md#worker-checklist
+    canon_ref: railiance-platform/docs/openbao.md
+    reviewed: "2026-08-22"
+    status: active
+    delegation:
+      mode: native
+      intended_owner: railiance-platform
+      reviewed: "2026-08-22"
+      verified: source-read
+    auth_method: "attended KeyCape OIDC/MFA at OpenBao auth mount netkingdom, role platform-admin"
+    fetch_command: "bao login -no-print -method=oidc -path=netkingdom role=platform-admin"
+    exec_capable: true
+    lane: login
+
   - id: whynot-design-npm-publish
     title: whynot-design npm publish token (@whynot/design → coulomb Gitea registry)
     # Publish rights to the package registry — a leaked token is a supply-chain write, not a read (WARDEN-WP-0032-T05).