feat(case): KERNEL-2/3 lane resolution and mode-aware admission; CATALOG-1 draft lanes

nk48 1.3 owner review (owner-review-ops-warden.json):
- KERNEL-2: Executor.admit parses catalog_source and resolves descriptor.lane;
  refuses a missing, non-active, undelegated or ungraded lane, an owner outside
  owner_repo, and a mint/change effect on a lane not graded risk high.
  catalog-routing-acceptance still covers the whole catalog digest.
- KERNEL-3: dispatch mode is read from the type's follow_through step
  (warden_executes/attended). The step must declare both booleans and a lane
  and agree with the descriptor's lane and owner. Attended: human actor,
  WARDEN_AGENT_ID unset, parent-session revocation scope, caller lane equal to
  the step lane. Owner: native delegation, owner_repo == descriptor.owner, no
  Warden-executed lane and no Warden-brokered mint.
- CATALOG-1: draft entries keycape-attended-case-change (OW-1.3-C1),
  platform-secret-delivery, consumer-owner-deployment, apps-consumer-handover.
  Not promoted; promotion waits for owner confirmation.
- Fixture catalogs and type steps in tests; published routing_lanes coverage
  and the workload-join count follow the four new not-applicable lanes.

PARAMETER_PINS untouched (PIN-1 waits for founder acknowledgment).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23

tests/test_case_inputs.py

@@ -44,6 +44,9 @@ def browser(rig, version="1.1", mutate=None):
         case["spec"]["parameters"]["consumer_namespace"] = "forgejo"
     # This extension and all native provenance are TEST ONLY, never source assent.
     typ["spec"]["execution_descriptors"] = {"mint-secret": digest(sources[2])}
+    for step in typ["spec"]["follow_through"]:
+        if step["id"] == "mint-secret":  # TEST ONLY: route to the fixture lane
+            step.update(owner="owner", lane="issuer-lane")
     if mutate:
         mutate(case, typ)
     changed = (