feat(case): KERNEL-2/3 lane resolution and mode-aware admission; CATALOG-1 draft lanes

nk48 1.3 owner review (owner-review-ops-warden.json):
- KERNEL-2: Executor.admit parses catalog_source and resolves descriptor.lane;
  refuses a missing, non-active, undelegated or ungraded lane, an owner outside
  owner_repo, and a mint/change effect on a lane not graded risk high.
  catalog-routing-acceptance still covers the whole catalog digest.
- KERNEL-3: dispatch mode is read from the type's follow_through step
  (warden_executes/attended). The step must declare both booleans and a lane
  and agree with the descriptor's lane and owner. Attended: human actor,
  WARDEN_AGENT_ID unset, parent-session revocation scope, caller lane equal to
  the step lane. Owner: native delegation, owner_repo == descriptor.owner, no
  Warden-executed lane and no Warden-brokered mint.
- CATALOG-1: draft entries keycape-attended-case-change (OW-1.3-C1),
  platform-secret-delivery, consumer-owner-deployment, apps-consumer-handover.
  Not promoted; promotion waits for owner confirmation.
- Fixture catalogs and type steps in tests; published routing_lanes coverage
  and the workload-join count follow the four new not-applicable lanes.

PARAMETER_PINS untouched (PIN-1 waits for founder acknowledgment).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23

registry/routing/catalog.yaml

@@ -1604,3 +1604,89 @@ entries:
       automatable: false
       steps:
         - "This lane covers first generation only and refuses an existing path (exit 3). Rotation is a separate railiance-platform task that does not exist yet; route rotation needs to railiance-platform."
+
+  # CATALOG-1 (nk48 1.3 owner review, 2026-10-17): four lanes for the 1.3
+  # SecurityCaseType oidc-browser-relying-party. Pointer only, draft. Each
+  # stays draft until its owner confirms the pointer
+  # (wiki/playbooks/catalog-lane-promotion.md); the kernel refuses draft lanes.
+  - id: keycape-attended-case-change
+    title: SecurityCase attended KeyCape change (ensure-groups, bind-env, register-client)
+    # OW-1.3-C1: dedicated attended change authority replacing key-cape-oidc-login
+    # for kernel-dispatched KeyCape registry, group and Deployment env changes.
+    # The session may be established by a key-cape OIDC login; that login lane
+    # stays the identity step, not the change authority.
+    risk: high
+    workload_ref:
+      applicability: not-applicable
+      reason: "Per-case attended change lane; the consuming service is a case parameter."
+    need_keywords: [keycape-attended-case-change, ensure-groups, bind-env, register-client, attended keycape change]
+    owner_repo: key-cape/net-kingdom
+    subsystem: key-cape registry and Deployment env, net-kingdom groups
+    warden_executes: false
+    wiki_ref: wiki/playbooks/catalog-lane-promotion.md
+    canon_ref: net-kingdom/security-case-types/oidc-browser-relying-party/type.yaml
+    reviewed: "2026-10-17"
+    status: draft
+    delegation:
+      mode: interim
+      intended_owner: key-cape
+      blocked_on: "key-cape and net-kingdom confirm the pointer and the re-frozen 1.3 descriptors (OW-1.3-C1)."
+      reviewed: "2026-10-17"
+      verified: source-read
+  - id: platform-secret-delivery
+    title: SecurityCase deliver-secret, KeyCape client secret delivered by Platform
+    risk: high
+    workload_ref:
+      applicability: not-applicable
+      reason: "Per-case delivery lane; each case's consuming service gets its own client entry."
+    need_keywords: [platform-secret-delivery, deliver-secret, keycape client secret delivery]
+    owner_repo: railiance-platform
+    subsystem: railiance-platform External Secrets delivery
+    warden_executes: false
+    wiki_ref: wiki/playbooks/catalog-lane-promotion.md
+    canon_ref: railiance-platform/AGENTS.md
+    reviewed: "2026-10-17"
+    status: draft
+    delegation:
+      mode: native
+      intended_owner: railiance-platform
+      reviewed: "2026-10-17"
+  - id: consumer-owner-deployment
+    title: SecurityCase deliver-consumer-secret, consumer deployment by its owner
+    # Descriptor actor is agent: ADR-0004 read boundary applies. Owner-side
+    # delivery only; no raw value reaches the agent session. If that cannot be
+    # shown, the actor changes to human and the railiance-apps digest changes.
+    risk: high
+    workload_ref:
+      applicability: not-applicable
+      reason: "Per-case consumer deployment; the consumer is a case parameter."
+    need_keywords: [consumer-owner-deployment, deliver-consumer-secret]
+    owner_repo: railiance-apps
+    subsystem: railiance-apps consumer deployment
+    warden_executes: false
+    wiki_ref: wiki/playbooks/catalog-lane-promotion.md
+    canon_ref: railiance-apps/AGENTS.md
+    reviewed: "2026-10-17"
+    status: draft
+    delegation:
+      mode: native
+      intended_owner: railiance-apps
+      reviewed: "2026-10-17"
+  - id: apps-consumer-handover
+    title: SecurityCase hand-over to the consuming service owner
+    risk: standard
+    workload_ref:
+      applicability: not-applicable
+      reason: "Per-case hand-over; the consumer owner is a case parameter."
+    need_keywords: [apps-consumer-handover, hand-over, consumer handover]
+    owner_repo: railiance-apps
+    subsystem: railiance-apps consumer hand-over
+    warden_executes: false
+    wiki_ref: wiki/playbooks/catalog-lane-promotion.md
+    canon_ref: railiance-apps/AGENTS.md
+    reviewed: "2026-10-17"
+    status: draft
+    delegation:
+      mode: native
+      intended_owner: railiance-apps
+      reviewed: "2026-10-17"