WARDEN-WP-0026 finish Strand A (T04/T05/T07)

Promote railiance-backup-offsite-lane to active/resolvable after
capabilities-safe re-verify. Add catalog risk=high, agent read-boundary
(exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and
close WP-0026.

tests/test_routing.py

@@ -531,3 +531,47 @@ def test_rotate_guide_cli_ssh_lane_is_graceful():
     # SSH renewal is re-issuance, not a static rotation — exit 0, not an error.
     result = runner.invoke(app, ["rotate-guide", "ssh-cert-host-access"])
     assert result.exit_code == 0
+
+
+# ---------------------------------------------------------------------------
+# Agent read-boundary + risk class (WARDEN-WP-0026 T04)
+# ---------------------------------------------------------------------------
+
+def test_high_risk_lanes_classified():
+    catalog = load_catalog(_repo_catalog())
+    high = {e.id for e in catalog.entries if e.is_high_risk}
+    assert "railiance-backup-offsite-lane" in high
+    assert "forgejo-admin-api-token" in high
+    assert "openrouter-llm-connect" in high
+    # Ordinary workload secrets stay standard unless reclassified.
+    assert catalog.get("issue-core-ingestion-api-key").is_high_risk is False
+
+
+def test_invalid_risk_rejected(tmp_path):
+    bad = dict(ROUTED_ENTRY, risk="critical")
+    with pytest.raises(CatalogError, match="risk"):
+        load_catalog(_write_catalog(tmp_path, [SSH_ENTRY, bad]))
+
+
+def test_backup_lane_promoted_and_resolvable():
+    """WP-0026 T07 — CCR-2026-0004 lane is active, resolvable, high-risk, has rotation."""
+    catalog = load_catalog(_repo_catalog())
+    e = catalog.get("railiance-backup-offsite-lane")
+    assert e is not None
+    assert e.status == "active"
+    assert e.resolvable is True
+    assert e.is_high_risk is True
+    assert e.has_rotation is True
+    assert e.rotation.method == "re-establish"
+    assert "NC_WEBDAV_TOKEN" in (e.fetch_command or "")
+    assert "<" not in (e.fetch_command or "")
+
+
+def test_route_show_json_includes_risk():
+    result = runner.invoke(app, ["route", "show", "railiance-backup-offsite-lane", "--json"])
+    assert result.exit_code == 0
+    payload = json.loads(result.stdout)
+    assert payload["risk"] == "high"
+    assert payload["high_risk"] is True
+    assert payload["resolvable"] is True
+    assert payload["status"] == "active"