fix: route OpenBao recovery ceremonies safely

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836

tests/test_routing.py

@@ -170,6 +170,18 @@ def test_platform_admin_login_lane_is_exact_and_non_value_bearing():
     assert entry.workload_ref.resolution == "not-applicable"
 
 
+def test_openbao_recovery_ceremony_is_non_value_bearing_owner_pointer():
+    entry = load_catalog(_repo_catalog()).get("openbao-shamir-recovery-ceremony")
+    assert entry.lane == "ceremony"
+    assert entry.risk == "high"
+    assert entry.owner_repo == "railiance-platform"
+    assert entry.warden_executes is False
+    assert entry.exec_capable is False
+    assert entry.has_handoff is False
+    assert entry.vends_secret is False
+    assert entry.workload_ref.resolution == "not-applicable"
+
+
 def test_find_exact_id_wins_over_keyword_collision():
     catalog = load_catalog(_repo_catalog())
     # "npm" alone collides with openbao-api-key; the exact id must resolve uniquely.