Cut forgejo package prune over to OpenBao lane

docs/forgejo-package-prune.md

@@ -18,31 +18,54 @@ tags slows backup growth and shortens chunked-copy duration.
 
 ## Operator commands
 
-### 1. Forgejo API token (one-time per workstation)
+### 1. Authenticate to the approved token lane
 
-This is **not** the OpenBao backup lane (`bao login` / Nextcloud). Prune uses a
-Forgejo **personal access token** with package scopes — same convention as
-`railiance-apps` (`FORGEJO_ADMIN_TOKEN`, `/tmp/forgejo-tegwick-api-token`).
+The steady-state credential path is `CCR-2026-0006`: OpenBao lane
+`platform/workloads/forgejo/forgejo-admin`, field `API_TOKEN`.
 
-1. Log in to https://forgejo.coulomb.social as `tegwick` (or another user with
-   org package admin rights on `coulomb`).
-2. **Settings → Applications → Generate New Token**
-3. Scopes: **`read:package`** and **`write:package`**
-4. Store on the workstation (pick one):
+1. Confirm the sanctioned route first:
 
 ```bash
-# Option A — token file (matches forgejo-operator-bootstrap, npm smoke, webhooks)
-install -m 600 /dev/null /tmp/forgejo-tegwick-api-token
-# paste token into the file (single line, no newline required)
-
-# Option B — env for one shell session
-export FORGEJO_TOKEN='<pat>'
-# alias: export FORGEJO_ADMIN_TOKEN='<pat>'
+warden plan "forgejo admin api token" --json
 ```
 
-Do not commit the token or paste it into workplans, State Hub, or chat.
+2. Login with an identity allowed to read the lane:
 
-### 2. Run prune
+```bash
+bao login -method=oidc -path=netkingdom role=forgejo-admin-workload-kv-read
+```
+
+3. Run prune normally. If `FORGEJO_TOKEN`, `FORGEJO_ADMIN_TOKEN`,
+   `FORGEJO_TOKEN_FILE`, and `FORGEJO_ADMIN_TOKEN_FILE` are unset, the loader
+   now resolves the PAT directly from OpenBao.
+
+Do not commit the token or paste it into workplans, State Hub, chat, or shell
+history.
+
+### 2. Break-glass overrides
+
+Short-lived overrides are still supported when the lane is unavailable or when
+an attended operator session needs an explicit handoff:
+
+```bash
+# Option A — token env for one shell session
+export FORGEJO_TOKEN='<pat>'
+# alias: export FORGEJO_ADMIN_TOKEN='<pat>'
+
+# Option B — explicit file path for one invocation
+warden access forgejo-admin-api-token --out "$XDG_RUNTIME_DIR/forgejo-admin.token" --field API_TOKEN
+FORGEJO_TOKEN_FILE="$XDG_RUNTIME_DIR/forgejo-admin.token" make forgejo-package-prune-dry-run
+rm -f "$XDG_RUNTIME_DIR/forgejo-admin.token"
+```
+
+The retired `/tmp/forgejo-tegwick-api-token` drop is no longer the default. Use
+it only while unwinding legacy local state:
+
+```bash
+FORGEJO_ALLOW_LEGACY_FILE_FALLBACK=1 make forgejo-package-prune-dry-run
+```
+
+### 3. Run prune
 
 ```bash
 cd ~/railiance-platform
@@ -64,4 +87,5 @@ counts (`deleted_count`, `candidate_count`, `skipped_protected_count`, `errors`)
 ## Related
 
 - `railiance-apps/docs/forgejo-package-registry.md`
-- `docs/forgejo-backup.md`
+- `docs/forgejo-backup.md`
+- `docs/workload-kv-access-lanes.md`