Add forgejo-admin-api-token catalog lane (CCR-2026-0006)

Draft routing entry and worker playbook for Forgejo site-admin PAT custody
in OpenBao. Workplan WARDEN-WP-0025 tracks approval, apply, and verification.

registry/routing/catalog.yaml

@@ -279,6 +279,23 @@ entries:
     exec_capable: true
     lane: secret
 
+  - id: forgejo-admin-api-token
+    title: Forgejo operator/admin API token (PAT)
+    need_keywords: [forgejo, admin, pat, package, prune, FORGEJO_ADMIN_TOKEN, forgejo-package-prune, forgejo-tegwick, webhook, npm]
+    owner_repo: railiance-platform
+    subsystem: OpenBao + Forgejo
+    warden_executes: false
+    wiki_ref: wiki/playbooks/forgejo-admin-api-token.md#worker-checklist
+    canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
+    reviewed: "2026-07-12"
+    status: draft
+    # CCR-2026-0006 proposed 2026-07-12; policy apply + PAT provision pending platform-operator approval.
+    auth_method: "caller's own OpenBao token (OIDC netkingdom role forgejo-admin-workload-kv-read)"
+    path_template: "platform/workloads/forgejo/forgejo-admin"
+    fetch_command: "bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin"
+    exec_capable: true
+    lane: secret
+
   # --- draft: owner path not yet shipped; hidden from default lookup ---
 
   - id: object-storage-sts