CCR-2026-0044 is applied. Member and non-member receipts passed on
2026-10-14: the member token holds only
workload-kv-read-reuse-surface-runtime, and a non-member login is
refused. The catalog auth_method is now that OIDC role. The proxy still
uses the ambient token and does not vend the hub writer value.
Assistant: grok
Assistant-Session: 01a13b2d-0bc1-7a91-ab1d-325bcfb09bf0