Close RAILIANCE-WP-0015-T06 rapp credential-lane binding

Document the one recipe a new rapp uses to acquire runtime secrets:
standing KV secrets bind through a CCR target.rapp, leases through
grant rapp_id. Stamp the existing postgres grants and the qonto
workload CCR. Gate, delivery, and revocation are unchanged.

credential-change-requests/CCR-2026-0009-qonto-assistant-workload-kv-read.yaml

@@ -5,7 +5,7 @@ request_type: workload-kv-read
 title: qonto-assistant workload access to tenants/binky/qonto-api
 status: proposed
 created: '2026-07-24'
-updated: '2026-07-24'
+updated: '2026-08-13'
 requester:
   agent: claude
   reason: >-
@@ -26,6 +26,7 @@ target:
   domain: financials
   tenant: binky
   workload: qonto-assistant
+  rapp: rapp-qonto
   environment: production
   purpose: >-
     Workload (not human/admin) read access to the existing