RPF-WP-0035-T03: fluid-telegram operator matrix lane and custody helpers

- New CCR request type workload-kv-operator-matrix (scripts/operator_matrix_lane.py):
  exact per-entry create/read/update, OIDC role on the existing netkingdom mount,
  and exact agent denies appended to the live agent-high-risk-boundary (live
  content preserved, partial presence refused). credential-change.py now
  dispatches lane request types through one module table.
- CCR-2026-0039 (proposed): hall-of-helix four-entry matrix at tenant coulomb
  per the founder ruling of 2026-10-09; policy, role and overlay sources.
- scripts/fluid_telegram_custody_move.py: silent CAS-0 move of the four
  undocumented infotech entries, deleting sources only after all verify.
- scripts/kv_duplicate_retire.py: silent retirement of
  activity-core/default/llm-connect-provider-secrets once no live non-admin
  policy grants it.
- Founder session commands recorded in the T03 note.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9

scripts/credential-change.py

@@ -516,8 +516,8 @@ def validate_ccr(path: Path) -> tuple[dict[str, Any], list[str], list[str]]:
         owner = importlib.util.module_from_spec(spec)
         spec.loader.exec_module(owner)
         errors.extend(owner.validate_contract(ccr))
-    elif request_type == "service-jwt-login":
-        errors.extend(service_jwt_lane().validate(ccr, REPO_DIR))
+    elif request_type in LANE_MODULES:
+        errors.extend(lane_module(ccr).validate(ccr, REPO_DIR))
     else:
         errors.append("unsupported request_type")
     return ccr, errors, warnings
@@ -819,6 +819,25 @@ def is_service_jwt(ccr: dict[str, Any]) -> bool:
     return ccr.get("request_type") == "service-jwt-login"
 
 
+# Request types whose delegated applier lives in its own reviewed module.
+LANE_MODULES = {
+    "service-jwt-login": "service_jwt_lane",
+    "workload-kv-operator-matrix": "operator_matrix_lane",
+}
+
+
+def lane_module(ccr: dict[str, Any]):
+    """Lazy-load the applier module for a lane request type, or None."""
+    name = LANE_MODULES.get(ccr.get("request_type"))
+    if name is None:
+        return None
+    import importlib.util
+    spec = importlib.util.spec_from_file_location(name, REPO_DIR / f"scripts/{name}.py")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
 def applier_policy_violations(ccr: dict[str, Any]) -> list[str]:
     violations: list[str] = []
     if ccr.get("request_type") != "workload-kv-read":
@@ -946,8 +965,9 @@ def applier_policy_violations(ccr: dict[str, Any]) -> list[str]:
 
 
 def applier_readiness_blockers(ccr: dict[str, Any]) -> list[str]:
-    if is_service_jwt(ccr):
-        return service_jwt_lane().readiness_blockers(ccr, REPO_DIR, APPLIER_DRY_RUN_ALLOWED_STATUSES)
+    lane = lane_module(ccr)
+    if lane is not None:
+        return lane.readiness_blockers(ccr, REPO_DIR, APPLIER_DRY_RUN_ALLOWED_STATUSES)
     blockers: list[str] = []
     status = ccr.get("status")
     if status not in APPLIER_DRY_RUN_ALLOWED_STATUSES:
@@ -962,8 +982,9 @@ def applier_readiness_blockers(ccr: dict[str, Any]) -> list[str]:
 
 
 def applier_dry_run_payload(ccr: dict[str, Any], warnings: list[str]) -> dict[str, Any]:
-    if is_service_jwt(ccr):
-        return service_jwt_lane().dry_run_payload(ccr, REPO_DIR, warnings)
+    lane = lane_module(ccr)
+    if lane is not None:
+        return lane.dry_run_payload(ccr, REPO_DIR, warnings)
     openbao = ccr["openbao"]
     auth = openbao["auth"]
     auth_path = f"auth/{auth['mount']}/role/{auth['role']}"
@@ -1052,8 +1073,9 @@ def applier_confirmation_phrase(ccr: dict[str, Any]) -> str:
 
 
 def delegated_apply_details(ccr: dict[str, Any], actor: str) -> list[str]:
-    if is_service_jwt(ccr):
-        return service_jwt_lane().apply_details(ccr, actor)
+    lane = lane_module(ccr)
+    if lane is not None:
+        return lane.apply_details(ccr, actor)
     openbao = ccr["openbao"]
     auth = openbao["auth"]
     return [
@@ -1214,8 +1236,8 @@ def render_runbook(payload: dict[str, Any]) -> str:
 
 
 def run_bao_metadata_apply(ccr: dict[str, Any], bao_bin: str, quiet: bool = False) -> None:
-    if is_service_jwt(ccr):
-        lane = service_jwt_lane()
+    lane = lane_module(ccr)
+    if lane is not None:
         try:
             lane.run_apply(ccr, REPO_DIR, bao_bin, quiet=quiet)
         except (lane.BaoError, subprocess.CalledProcessError) as exc: