Draft the flex-auth envelope-signing credential route.

Pointer-only, warden_executes false. Shape lives in flex-auth;
OpenBao path is not built yet. Testdata keys are not this lane.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

registry/generated/high-risk-data-paths.yaml

@@ -10,18 +10,19 @@
 # declares it, and is null where the field set has not been established --
 # null means unknown, never 'one field'.
 
-generated_at: "2026-09-14T02:57:04Z"
+generated_at: "2026-09-14T07:58:30Z"
 source: ops-warden/registry/routing/catalog.yaml
-catalog_revision: "73e40af6ca27ca547eb42782d2ceb1a5cc8c3534"
-catalog_revision_date: "2026-09-14T02:47:32+02:00"
+catalog_revision: "4ebd241d88e0f65125b3097a6d3aeccd4c294eb6"
+catalog_revision_date: "2026-09-14T04:57:55+02:00"
 catalog_dirty: true
-high_risk_lane_count: 27
+high_risk_lane_count: 28
 concrete_path_count: 15
 
 # Graded high but not a single KV address -- a routing pattern, a broker
 # grant, or a non-KV lane. Nothing here for a policy to deny.
 no_concrete_path:
   - database-dynamic-credentials
+  - flex-auth-decision-envelope-signing-key
   - inter-hub-bootstrap-ssh
   - net-kingdom-lldap-bind-credential
   - net-kingdom-privacyidea-admin-token