CCR-2026-0064 (proposed): read-only window watch for the CCR-2026-0058 write role (net-kingdom NK-WP-0058-T06)

New request type auth-role-presence-watch (scripts/auth_role_watch_lane.py, registered in LANE_MODULES):
a Kubernetes-auth role for sso/nk-window-watch whose policy is generated from the CCR - read (mode flag)
or read and delete (mode close) on exactly one watched role path, plus token self-lifecycle. Validator
refuses any widening; apply writes policy and role and reads both back; tests with a fake bao.
Drafted by net-kingdom on the founder's instruction for platform-owner review. Mode flag; not approved.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0

scripts/credential-change.py

@@ -851,6 +851,7 @@ LANE_MODULES = {
     "workload-kv-operator-matrix": "operator_matrix_lane",
     "custody-generate-grant": "broker_grant_lane",
     "broker-issuer-binding": "issuer_binding_lane",
+    "auth-role-presence-watch": "auth_role_watch_lane",
 }