fix: route OpenBao platform administration login

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836

tests/test_plan.py

@@ -53,6 +53,33 @@ def test_plan_login_founder_required():
     assert plan.founder_act.kind == "oidc_login"
 
 
+def test_plan_first_time_openbao_database_admin_uses_platform_admin_login():
+    plan = build_plan(
+        "first-time OpenBao database engine administration for "
+        "database/config/platform-pg-2 dynamic roles policies and token roles; "
+        "requires attended platform-admin handoff"
+    )
+    assert plan.verdict == "founder_required"
+    assert plan.lane_id == "openbao-platform-admin-login"
+    assert plan.founder_act is not None
+    assert plan.founder_act.kind == "oidc_login"
+    command = plan.founder_act.details["fetch_command"]
+    assert command == (
+        "bao login -no-print -method=oidc -path=netkingdom role=platform-admin"
+    )
+    assert "financials" not in command
+    assert "paste_once" not in plan.founder_act.details["desk_hint"]
+    assert any(
+        item == "warden access openbao-platform-admin-login --fetch"
+        for item in plan.commands
+    )
+    assert not any(
+        flag in item
+        for item in plan.commands
+        for flag in ("--exec", "--out", "--wrap")
+    )
+
+
 def test_plan_unroutable():
     # Zero keyword overlap with catalog (avoid tokens like secret/key/token)
     plan = build_plan("xyzzy-plugh-fnord-qqq-zzzz")