RPF-WP-0054-T04: create-only broker grant keycape/client-secret-generate

- New CCR request type custody-generate-grant (scripts/broker_grant_lane.py):
  grant policy (create on keycape/+ data, read on metadata, deny on reserved
  entries, revoke-self; no update, data read, metadata write, list or
  delete), broker issuer policy and a 5m orphan non-renewable token role,
  with readback. Binds no identity, so the apply is inert until T01.
- CCR-2026-0040 (proposed), catalog grant (pilot, approval-required,
  exec-env only), generated policies, tests.
- T03 drops custom_metadata: a metadata write would also allow changing
  other entries' version settings.
- test_operator_matrix_lane follows CCR-2026-0039 now being applied.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9

scripts/credential-change.py

@@ -823,6 +823,7 @@ def is_service_jwt(ccr: dict[str, Any]) -> bool:
 LANE_MODULES = {
     "service-jwt-login": "service_jwt_lane",
     "workload-kv-operator-matrix": "operator_matrix_lane",
+    "custody-generate-grant": "broker_grant_lane",
 }