Route coulomb-social runtime env credentials via ops-warden catalog

Add coulomb-social-runtime-env lane and playbook. Points operators at
railiance-apps env-secret assembly; ops-warden never holds values.

registry/routing/catalog.yaml

@@ -599,3 +599,41 @@ entries:
         - "bao write -f auth/approle/role/rein-openweights/secret-id -> new secret_id; deliver mode-0600 to REIN_OPENWEIGHTS_APPROLE_DIR; shred old secret_id file."
         - "Optionally re-mint the OpenRouter key itself if it rotated independently."
         - "Verify AppRole login + field presence (length only); confirm default/other policies still deny sibling paths."
+
+  - id: coulomb-social-runtime-env
+    title: coulomb.social runtime env Secret (SECRET_KEY, DATABASE_URL, USER_ENGINE_PROXY_SECRET)
+    need_keywords:
+      - coulomb-social
+      - coulomb.social
+      - coulomb social
+      - csoc
+      - runtime-env
+      - coulomb-social-env
+      - django secret_key
+      - user-engine-proxy
+      - apps-pg coulomb
+    owner_repo: railiance-platform
+    subsystem: K8s Secrets + apps-pg (OpenBao path planned)
+    warden_executes: false
+    wiki_ref: wiki/playbooks/coulomb-social-runtime-env.md#worker-checklist
+    canon_ref: railiance-platform/docs/apps-pg.md
+    reviewed: "2026-08-09"
+    status: active
+    risk: standard
+    # K8s assembly is the live handoff today (same pattern as vergage-teilnahme-env).
+    # OpenBao KV platform/workloads/coulomb/coulomb-social/runtime-env is the
+    # future custody home — CCR not yet applied; resolvable via operator script.
+    auth_method: "kubectl as platform operator (or bao OIDC when OpenBao lane is provisioned)"
+    path_template: "k8s:coulomb-social/coulomb-social-env"
+    fetch_command: "cd ~/railiance-apps && make coulomb-social-env-secret-dry-run  # then make coulomb-social-env-secret (values never printed)"
+    exec_capable: false
+    lane: secret
+    resolvable: true
+    rotation:
+      method: rotate
+      owner: railiance-apps
+      automatable: false
+      steps:
+        - "SECRET_KEY: make coulomb-social-env-secret COULOMB_SOCIAL_ENV_SECRET_ARGS='--rotate-secret-key' then rollout restart deploy/coulomb-social."
+        - "USER_ENGINE_PROXY_SECRET: rotate user-engine/user-engine-runtime, re-run make coulomb-social-env-secret, restart app."
+        - "DATABASE_URL: platform rotates apps-pg role password secret; re-run make coulomb-social-env-secret; restart app."