chore: refresh high-risk credential paths

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

registry/generated/high-risk-data-paths.yaml

@@ -10,13 +10,13 @@
 # declares it, and is null where the field set has not been established --
 # null means unknown, never 'one field'.
 
-generated_at: "2026-08-29T00:44:23Z"
+generated_at: "2026-08-31T22:46:47Z"
 source: ops-warden/registry/routing/catalog.yaml
-catalog_revision: "ee94c189385271194f22a53998b2c6e12e961ea9"
-catalog_revision_date: "2026-08-28T22:00:09+02:00"
+catalog_revision: "4fee839b1138c60642bd6e0210cf8bf541333747"
+catalog_revision_date: "2026-09-01T00:46:28+02:00"
 catalog_dirty: false
-high_risk_lane_count: 23
-concrete_path_count: 14
+high_risk_lane_count: 24
+concrete_path_count: 15
 
 # Graded high but not a single KV address -- a routing pattern, a broker
 # grant, or a non-KV lane. Nothing here for a policy to deny.
@@ -77,6 +77,11 @@ paths:
     metadata_path: platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets
     owner_repo: railiance-platform
     fields: null   # field set not established -- unknown, not one
+  - id: policy-nexus-forgejo-source-read
+    data_path: platform/data/workloads/policy-nexus/forgejo-source-read
+    metadata_path: platform/metadata/workloads/policy-nexus/forgejo-source-read
+    owner_repo: railiance-platform
+    fields: null   # field set not established -- unknown, not one
   - id: railiance-backup-offsite-lane
     data_path: platform/data/workloads/railiance/backup/offsite-lane
     metadata_path: platform/metadata/workloads/railiance/backup/offsite-lane