feat(case): KERNEL-2/3 lane resolution and mode-aware admission; CATALOG-1 draft lanes

nk48 1.3 owner review (owner-review-ops-warden.json):
- KERNEL-2: Executor.admit parses catalog_source and resolves descriptor.lane;
  refuses a missing, non-active, undelegated or ungraded lane, an owner outside
  owner_repo, and a mint/change effect on a lane not graded risk high.
  catalog-routing-acceptance still covers the whole catalog digest.
- KERNEL-3: dispatch mode is read from the type's follow_through step
  (warden_executes/attended). The step must declare both booleans and a lane
  and agree with the descriptor's lane and owner. Attended: human actor,
  WARDEN_AGENT_ID unset, parent-session revocation scope, caller lane equal to
  the step lane. Owner: native delegation, owner_repo == descriptor.owner, no
  Warden-executed lane and no Warden-brokered mint.
- CATALOG-1: draft entries keycape-attended-case-change (OW-1.3-C1),
  platform-secret-delivery, consumer-owner-deployment, apps-consumer-handover.
  Not promoted; promotion waits for owner confirmation.
- Fixture catalogs and type steps in tests; published routing_lanes coverage
  and the workload-join count follow the four new not-applicable lanes.

PARAMETER_PINS untouched (PIN-1 waits for founder acknowledgment).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23

registry/generated/high-risk-data-paths.yaml

@@ -10,22 +10,24 @@
 # declares it, and is null where the field set has not been established --
 # null means unknown, never 'one field'.
 
-generated_at: "2026-10-14T20:20:19Z"
+generated_at: "2026-10-17T10:04:57Z"
 source: ops-warden/registry/routing/catalog.yaml
 catalog_revision: "402b008986c3a710c4f5b41bb1007a55c8d4363e"
 catalog_revision_date: "2026-10-14T22:20:15+02:00"
-catalog_dirty: false
-high_risk_lane_count: 35
+catalog_dirty: true
+high_risk_lane_count: 38
 concrete_path_count: 17
 
 # Graded high but not a single KV address -- a routing pattern, a broker
 # grant, or a non-KV lane. Nothing here for a policy to deny.
 no_concrete_path:
+  - consumer-owner-deployment
   - database-dynamic-credentials
   - flex-auth-decision-envelope-signing-key
   - fluid-telegram-operator
   - informed-decision-sitting-requester-login
   - inter-hub-bootstrap-ssh
+  - keycape-attended-case-change
   - keycape-client-secret-generate
   - net-kingdom-lldap-bind-credential
   - net-kingdom-privacyidea-admin-token
@@ -35,6 +37,7 @@ no_concrete_path:
   - openbao-shamir-recovery-ceremony
   - openbao-structure-survey
   - ops-warden-warden-sign-token
+  - platform-secret-delivery
   - platform-supplier-credentials
   - secrets-engine-approval-client-login
   - secrets-engine-requester-login