RPF-WP-0054: record CCR-2026-0040 apply; fix State Hub evidence crash for prefix lanes

The founder apply wrote and read back both policies and the token role, then
record_evidence_state_hub raised KeyError on openbao.auth (custody-generate-grant
has kv_prefix, no auth), printing a traceback that made warden revoke the
session. The summary now falls back across kv_path, kv_prefix, campaign_path
and auth.mount. The missed hub event was posted afterwards.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9

scripts/credential-change.py

@@ -1331,10 +1331,19 @@ def record_evidence_state_hub(
     ccr: dict[str, Any], base_url: str, actor: str, kind: str, result: str, details: list[str]
 ) -> dict[str, Any]:
     openbao = ccr["openbao"]
+    # Lane request types differ: workload-kv-read has kv_path, auth lanes have
+    # auth.mount, custody-generate-grant has kv_prefix. Never fail after an apply.
+    auth_mount = (openbao.get("auth") or {}).get("mount")
+    target = (
+        openbao.get("kv_path")
+        or openbao.get("kv_prefix")
+        or openbao.get("campaign_path")
+        or (f"auth/{auth_mount}" if auth_mount else "unknown")
+    )
     summary = (
         f"CCR {ccr['id']} evidence {kind}/{result} by {actor}: "
-        f"status={ccr['status']} path={openbao.get('kv_path') or 'auth/' + openbao['auth']['mount']} "
-        f"policy={openbao['policy_name']}; "
+        f"status={ccr['status']} path={target} "
+        f"policy={openbao.get('policy_name', 'unknown')}; "
         + "; ".join(details)
     )
     return state_hub_post_json(