Stabilize credential-change test suite (RAILIANCE-WP-0014)

Five failures in full credential test discovery, none of them broker
regressions:

- CCR-2026-0009 referenced a policy file that was never added, and used a
  schema-invalid access_frontdoor.readiness value. Add the least-privilege
  workload-kv-read-qonto-assistant.hcl (read-only on tenants/binky/qonto-api)
  and set readiness to pending-review. The lane stays proposed and
  non-resolvable.

- Three refusal tests used the live CCR-2026-0002 file as their "unapproved
  CCR" fixture. That lane is now approved, applied and active, so the gates
  correctly permitted it and the tests failed; applier-apply then walked into
  its interactive confirmation prompt and raised EOFError under a
  non-interactive runner. Add an unapproved_ccr() helper that materializes a
  normalized temp copy so approval state is no longer read off a mutable
  production artifact.

- The approve/unconfirmed-claim test demoted an active CCR to approved while
  leaving resolvable=true, tripping a correct validation rule. Build it from
  the same helper.

No gate, blocker, validation rule, or grant semantic was changed. Verified:
credential discovery 52/52 and full discovery 61/61 pass non-interactively,
make credential-change-validate passes all nine CCRs, the grant catalog
validates, and both audit-core openbao-database-credential grants retain
exec-env-only delivery and revoke-on-exec-exit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

openbao/policies/workload-kv-read-qonto-assistant.hcl

@@ -0,0 +1,15 @@
+# Least-privilege read policy for the qonto-assistant workload access lane.
+# Tenant mount (WARDEN-WP-0028) — client commercial secrets, not platform workloads.
+# Live path: tenants/binky/qonto-api (fields API_KEY, API_USER).
+# Second, workload-scoped lane onto the same value CCR-2026-0008 vends to the
+# human/OIDC admin lane; see CCR-2026-0009. Kubernetes auth subject is
+# external-secrets/external-secrets, ClusterSecretStore scoped to the
+# qonto-assistant namespace only. Read-only; no secret writes from this lane.
+
+path "tenants/data/binky/qonto-api" {
+  capabilities = ["read"]
+}
+
+path "tenants/metadata/binky/qonto-api" {
+  capabilities = ["read"]
+}