Add NetKingdom SSO credential routing lanes

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

tests/test_routing.py

@@ -170,6 +170,23 @@ def test_platform_admin_login_lane_is_exact_and_non_value_bearing():
     assert entry.workload_ref.resolution == "not-applicable"
 
 
+def test_netkingdom_sso_bind_lanes_are_routed_but_not_resolvable():
+    catalog = load_catalog(_repo_catalog())
+    for lane_id in (
+        "net-kingdom-lldap-bind-credential",
+        "net-kingdom-privacyidea-admin-token",
+    ):
+        entry = catalog.get(lane_id)
+        assert entry is not None
+        assert entry.owner_repo == "railiance-platform"
+        assert entry.risk == "high"
+        assert entry.warden_executes is False
+        assert entry.exec_capable is False
+        assert entry.resolvable is False
+        assert entry.delegation.blocked_on
+        assert "net-kingdom-sso-bind-credentials.md#worker-checklist" in entry.wiki_ref
+
+
 def test_openbao_recovery_ceremony_is_non_value_bearing_owner_pointer():
     entry = load_catalog(_repo_catalog()).get("openbao-shamir-recovery-ceremony")
     assert entry.lane == "ceremony"