Update WARDEN-WP-0025 after CCR-2026-0006 metadata apply

Mark T03 done, T04 in progress; document forgejo-admin-pat-provision.sh
in the worker playbook.

wiki/playbooks/forgejo-admin-api-token.md

@@ -80,12 +80,11 @@ After CCR approval and policy apply:
 2. Store in OpenBao (do not echo the value):
 
    ```bash
-   bao kv put platform/workloads/forgejo/forgejo-admin \
-     API_TOKEN=@/path/to/pat-file \
-     API_USER=tegwick \
-     API_BASE_URL=https://forgejo.coulomb.social \
-     TOKEN_SCOPES='read:package,write:package,read:repository,write:repository' \
-     GENERATED_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+   # PAT in a mode-0600 single-line file — never on argv
+   install -m 600 /dev/null /tmp/forgejo-admin-pat.input
+   # paste token into the file, then:
+   ~/railiance-platform/scripts/forgejo-admin-pat-provision.sh /tmp/forgejo-admin-pat.input
+   shred -u /tmp/forgejo-admin-pat.input
    ```
 
 3. Verify field presence without printing values: