auth-role-presence-watch: dry-run policy_write carries source and body; approve state-hub summary tolerates non-KV CCRs

The founder's applier-dry-run of CCR-2026-0064 crashed (KeyError 'source') in render_applier_dry_run.
New test renders the dry run and the apply plan through the CLI. The --record-state-hub summary of
approve no longer assumes openbao.fields, which lane CCRs without a KV path do not have.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0

scripts/auth_role_watch_lane.py

@@ -137,8 +137,7 @@ def dry_run_payload(ccr: dict[str, Any], repo_dir: Path, warnings: list[str]) ->
         "source_artifacts": {"policy_file": openbao["policy_file"]},
         "mutations": [
             {"kind": "policy_write", "openbao_path": f"sys/policies/acl/{openbao['policy_name']}",
-             "payload": {"source": openbao["policy_file"], "watched_path": watched_path(ccr),
-                         "capabilities": MODES[openbao["watch"]["mode"]]}},
+             "source": openbao["policy_file"], "body": generated_policy_hcl(ccr)},
             {"kind": "auth_role_write", "openbao_path": f"auth/{auth['mount']}/role/{auth['role']}",
              "payload": role_payload(ccr), "precondition": "auth/kubernetes exists (never enabled here)"},
             {"kind": "readback_compare", "openbao_path": "policy and role", "payload": {"prints": "booleans only"}},

scripts/credential-change.py

@@ -2304,7 +2304,7 @@ def command_decision(args: argparse.Namespace, status: str) -> int:
                 "summary": (
                     f"CCR {ccr['id']} decision {status} by {args.reviewer}: "
                     f"path={openbao.get('kv_path', '-')} policy={openbao['policy_name']} "
-                    f"fields={','.join(openbao['fields'])} "
+                    f"fields={','.join(openbao.get('fields') or []) or '-'} "
                     f"auth_role=auth/{auth['mount']}/role/{auth['role']}; "
                     f"{args.comment}"
                 ),