Route attended approval-client login to scoped OpenBao reader

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

registry/routing/catalog.yaml

@@ -190,6 +190,30 @@ entries:
     exec_capable: true
     lane: login
 
+  - id: secrets-engine-approval-client-login
+    title: Attended secrets-engine approval client reader login
+    risk: high
+    workload_ref:
+      applicability: not-applicable
+      reason: "Attended operator identity for the exact CCR-2026-0019 reader."
+    need_keywords: [secrets-engine, approval-client, reader, login, ccr-2026-0019]
+    owner_repo: railiance-platform
+    subsystem: OpenBao scoped operator OIDC via KeyCape
+    warden_executes: false
+    wiki_ref: wiki/playbooks/secrets-engine-approval-client-login.md
+    canon_ref: railiance-platform/credential-change-requests/CCR-2026-0019-secrets-engine-approval-client-read.yaml
+    reviewed: "2026-09-14"
+    status: active
+    delegation:
+      mode: native
+      intended_owner: railiance-platform
+      reviewed: "2026-09-14"
+      verified: source-read
+    auth_method: "attended KeyCape OIDC, netkingdom role secrets-engine-approval-client-workload-kv-read"
+    fetch_command: "bao login -no-print -method=oidc -path=netkingdom role=secrets-engine-approval-client-workload-kv-read"
+    exec_capable: true
+    lane: login
+
   - id: openbao-shamir-recovery-ceremony
     title: Attended OpenBao Shamir seal and unseal recovery ceremony
     # A ceremony pointer, not a credential-value lane. Approval coordinates