WARDEN-WP-0028: tenant secrets on mount tenants/ (first lane draft)

Adopt tenants/<tenant>/… custody (not platform/workloads). Document
onboarding, add draft binky-company-email-imap catalog entry, and mark
T01–T04/T06–T07 done. Founder Red provision remains T05.

registry/routing/catalog.yaml

@@ -390,6 +390,37 @@ entries:
         - "Confirm the new PAT works (fetch --field API_TOKEN into env, call /api/v1/user — never print it), then delete the old token in Forgejo."
         - "Verify capabilities-safe on the data path (`bao token capabilities`); notify consumers (package-prune, operator-bootstrap, npm-smoke, reuse-webhook) to re-fetch."
 
+  # --- tenant commercial secrets (mount tenants/; WARDEN-WP-0028) ---
+
+  - id: binky-company-email-imap
+    title: Binky company email IMAP credentials
+    need_keywords: [binky, company, email, imap, mailbox, binky-hedgehog, mail, company-email]
+    owner_repo: railiance-platform
+    subsystem: OpenBao + email-connect
+    warden_executes: false
+    wiki_ref: wiki/playbooks/binky-company-email-imap.md#worker-checklist
+    canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
+    reviewed: "2026-07-17"
+    status: draft
+    risk: high
+    # CCR-2026-0007: tenants/ mount + policy + OIDC role applied 2026-07-17.
+    # Values: founder Red provision pending. Promote to active after provision +
+    # capabilities-safe verify. Sibling non-secret host/port in email-connect config.
+    auth_method: "caller's own OpenBao token (OIDC netkingdom role binky-company-email-imap-workload-kv-read)"
+    path_template: "tenants/binky/company-email/imap"
+    fetch_command: "bao kv get -field=IMAP_PASSWORD tenants/binky/company-email/imap"
+    exec_capable: true
+    lane: secret
+    rotation:
+      method: rotate
+      owner: binky-control
+      automatable: false
+      steps:
+        - "At the mail provider, revoke the old app password / mailbox password and mint a new one (do not paste it into chat or Git)."
+        - "`bao kv put tenants/binky/company-email/imap IMAP_PASSWORD=@file` (and IMAP_USERNAME=@file if the login changed); shred the mode-0600 input file(s)."
+        - "Re-run email-connect read-only scan with warden access --exec / env inject; confirm metadata-only evidence under binky-control/mailmeta/."
+        - "Verify capabilities-safe on tenants/data/binky/company-email/imap; if EXPOSED taint was set, clear custom_metadata after rotation."
+
   # --- draft: owner path not yet shipped; hidden from default lookup ---
 
   - id: object-storage-sts