Add platform-supplier-credentials pointer and review the OIDC RP follow-through

WARDEN-WP-0043-T01: pointer lane and playbook for
platform/suppliers/<supplier>/<account>. railiance-platform owns the write;
warden_executes false.

WARDEN-WP-0044-T01: review of net-kingdom's oidc-browser-relying-party 1.0
follow_through section. Requires a per-step lane, a narrow
warden_executes, and value_handling.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327285@bnt-lap001
Assistant-Session: d6532cd1-7cd5-417b-baac-b841c9103a6b

tests/test_workload_join.py

@@ -21,8 +21,10 @@ def test_repo_catalog_uses_only_explicit_workload_references():
     # and pep-stance.yaml's classification_coverage measure the same populations
     # and must be updated together. 16 since 2026-10-05: the
     # openbao-structure-survey pointer (WARDEN-WP-0042) is a builder survey
-    # under a founder-minted grant, not a workload credential.
-    assert len(report["not_applicable"]) == 16
+    # under a founder-minted grant, not a workload credential. 17 since
+    # 2026-10-08: platform-supplier-credentials (WARDEN-WP-0043) is a generic
+    # supplier-account path pattern; concrete consumers keep their own lanes.
+    assert len(report["not_applicable"]) == 17
     assert {row["lane"] for row in report["resolved"]} == {
         "ops-warden-warden-sign-token",
         "issue-core-ingestion-api-key",