Add forgejo-admin-api-token catalog lane (CCR-2026-0006)

Draft routing entry and worker playbook for Forgejo site-admin PAT custody
in OpenBao. Workplan WARDEN-WP-0025 tracks approval, apply, and verification.

workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md

@@ -0,0 +1,106 @@
+---
+id: WARDEN-WP-0025
+type: workplan
+title: "Forgejo admin PAT OpenBao lane (CCR-2026-0006)"
+domain: infotech
+repo: ops-warden
+status: active
+owner: grok
+topic_slug: custodian
+planning_priority: high
+planning_order: 25
+created: "2026-07-12"
+updated: "2026-07-12"
+---
+
+# WARDEN-WP-0025 — Forgejo admin PAT OpenBao lane
+
+**Trigger:** the-custodian CCR request (msg `54125f84`) — establish OpenBao custody
+for the Forgejo site-admin PAT at `platform/workloads/forgejo/forgejo-admin`.
+Drivers: `ACTIVITY-WP-0020` weekly package prune and railiance-apps/platform tools
+still using `/tmp/forgejo-tegwick-api-token` or `FORGEJO_ADMIN_TOKEN`.
+
+**Boundary:** ops-warden holds no PAT; workstation OIDC fetch mirrors
+`railiance-backup-offsite-lane` (CCR-2026-0004). Distinct from `forgejo-mailer`
+(SMTP via ESO). Phase 1: no cluster ExternalSecret.
+
+**Depends on:** platform-operator approval of CCR-2026-0006; attended PAT mint.
+
+---
+
+## Tasks
+
+### T1 — Draft CCR + policy metadata
+
+```task
+id: WARDEN-WP-0025-T01
+status: done
+priority: high
+```
+
+- [x] `CCR-2026-0006-forgejo-admin-api-token-lane.yaml` (`status: proposed`)
+- [x] `openbao/policies/workload-kv-read-forgejo-admin.hcl`
+- [x] `docs/workload-kv-access-lanes.md` section
+
+### T2 — ops-warden catalog + playbook
+
+```task
+id: WARDEN-WP-0025-T02
+status: done
+priority: high
+```
+
+- [x] Catalog entry `forgejo-admin-api-token` (`status: draft`)
+- [x] `wiki/playbooks/forgejo-admin-api-token.md`
+
+### T3 — Platform-operator approval + metadata apply
+
+```task
+id: WARDEN-WP-0025-T03
+status: todo
+priority: high
+```
+
+- [ ] CCR approved by platform-operator
+- [ ] `scripts/credential-change.py applier-dry-run CCR-2026-0006`
+- [ ] Policy `workload-kv-read-forgejo-admin` + OIDC role `forgejo-admin-workload-kv-read` applied on `bao.coulomb.social`
+- [ ] Non-secret `delegated_metadata_apply` evidence on CCR
+
+### T4 — Attended PAT provision + verification
+
+```task
+id: WARDEN-WP-0025-T04
+status: todo
+priority: high
+```
+
+- [ ] Mint PAT as Forgejo user `tegwick` (attended)
+- [ ] `bao kv put platform/workloads/forgejo/forgejo-admin` (API_TOKEN + metadata)
+- [ ] Positive fetch after OIDC login; negative default-policy denial
+- [ ] `warden route find "forgejo admin pat"` resolves; promote catalog to `active` when verified
+
+### T5 — Notify downstream consumers
+
+```task
+id: WARDEN-WP-0025-T05
+status: wait
+priority: medium
+```
+
+- [ ] Ack the-custodian with CCR id + catalog id (no secret values)
+- [ ] Signal railiance-platform / activity-core / railiance-apps to wire `load_token()` OpenBao paths
+
+---
+
+## Acceptance
+
+- CCR-2026-0006 approved, policy + OIDC role live, PAT in OpenBao
+- `warden route find "forgejo admin pat"` → `forgejo-admin-api-token`
+- No PAT in Git, State Hub, workplans, logs, or chat
+- Workstation file drop retired as steady-state path after downstream wiring
+
+## See also
+
+- `railiance-platform/credential-change-requests/CCR-2026-0006-forgejo-admin-api-token-lane.yaml`
+- `activity-core/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md`
+- Custodian message `54125f84-e9df-4fa0-9309-7370633a20d3`