Re-emit the high-risk path artifact after the NetKingdom SSO lanes

c374d41 added net-kingdom-lldap-bind-credential and
net-kingdom-privacyidea-admin-token as `risk: high` and did not re-run the
emitter, so registry/generated/high-risk-data-paths.yaml still described the
catalog at 0fae090. railiance-platform consumes that file instead of
hand-maintaining its deny list, and it has been reading a census two lanes short
since 2026-08-23.

This is precisely the drift WARDEN-WP-0033-T03 built the guard for — a lane
graded high after the last emit silently failing to reach the consumer. The
guard fired; nothing had acted on it.

The deny list itself does not move: both lanes are blocked on their OpenBao path
being published, so they land in `no_concrete_path` and concrete_path_count
stays 14. What changes is the count the consumer sees — 23 high-risk lanes, two
of which have no address yet. That is the honest signal and the reason the
bucket is listed rather than omitted.

check_agent_read_boundary.py still reports 0 uncovered.

The workload-join census moves 9 -> 11 not-applicable: both lanes are
provider/control-plane credentials rather than workload delivery lanes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YWBMovyFoy9RRrfL7zKvPJ

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4014535@bnt-lap001
Assistant-Session: d0036016-73e8-4da1-8e47-563e3ab39a3c

registry/generated/high-risk-data-paths.yaml

@@ -10,12 +10,12 @@
 # declares it, and is null where the field set has not been established --
 # null means unknown, never 'one field'.
 
-generated_at: "2026-08-22T23:31:10Z"
+generated_at: "2026-08-28T19:54:29Z"
 source: ops-warden/registry/routing/catalog.yaml
-catalog_revision: "0fae0904ce8d8694338dd53a8a79abec5fec788d"
-catalog_revision_date: "2026-08-23T01:31:05+02:00"
+catalog_revision: "c374d41a4925720ae7706dfda020537b60a07eb9"
+catalog_revision_date: "2026-08-23T21:43:12+02:00"
 catalog_dirty: false
-high_risk_lane_count: 21
+high_risk_lane_count: 23
 concrete_path_count: 14
 
 # Graded high but not a single KV address -- a routing pattern, a broker
@@ -23,6 +23,8 @@ concrete_path_count: 14
 no_concrete_path:
   - database-dynamic-credentials
   - inter-hub-bootstrap-ssh
+  - net-kingdom-lldap-bind-credential
+  - net-kingdom-privacyidea-admin-token
   - object-storage-sts
   - openbao-api-key
   - openbao-platform-admin-login

tests/test_workload_join.py

@@ -14,7 +14,9 @@ def test_repo_catalog_uses_only_explicit_workload_references():
     assert report["ok"] is True
     assert len(report["resolved"]) == 3
     assert len(report["unknown"]) == 17
-    assert len(report["not_applicable"]) == 9
+    # 11 since WARDEN-WP-0033: the two NetKingdom SSO lanes (c374d41) are
+    # provider/control-plane credentials, not workload delivery lanes.
+    assert len(report["not_applicable"]) == 11
     assert {row["lane"] for row in report["resolved"]} == {
         "ops-warden-warden-sign-token",
         "issue-core-ingestion-api-key",