Complete RAILIANCE-WP-0011-T03 catalog migration for CCR-2026-0005

Activate CCR front door, document reuse-surface lane in workload-kv-access-lanes,
and mark consumer handoff task done.

credential-change-requests/CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: reuse-surface runtime secrets lane
-status: verified
+status: active
 created: '2026-07-07'
 updated: '2026-07-07'
 requester:
@@ -71,8 +71,9 @@ access_frontdoor:
   catalog_id: reuse-surface-hub-write-token
   selector: reuse-surface federation hub write bearer token
   command: warden access reuse-surface-hub-write-token --fetch REUSE_SURFACE_TOKEN
-  resolvable: false
-  readiness: pending-review
+  resolvable: true
+  readiness: ready
+  activation: verified-positive-and-negative-access-frontdoor-active-2026-07-07
 delivery:
   surface: external-secrets
   target: ExternalSecret reuse/reuse-surface-runtime -> Secret reuse-surface-env in
@@ -141,6 +142,13 @@ verification:
     details:
     - default-policy OpenBao token denied on platform/workloads/reuse/reuse-surface/runtime-secrets
       (HTTP permission denied)
+  - at: '2026-07-07T20:38:32+00:00'
+    actor: bernd.worsch
+    kind: frontdoor_activation
+    result: passed
+    details:
+    - ops-warden catalog reuse-surface-hub-write-token migrated to bao kv get handoff;
+      resolvable=true; playbook and workload-kv-access-lanes updated (RAILIANCE-WP-0011-T03)
 lifecycle:
   deactivate: Disable ops-warden catalog entry, remove ExternalSecret, and detach
     auth role policy; delete materialized reuse-surface-env only after confirming