Close RAILIANCE-WP-0015-T06 rapp credential-lane binding

Document the one recipe a new rapp uses to acquire runtime secrets:
standing KV secrets bind through a CCR target.rapp, leases through
grant rapp_id. Stamp the existing postgres grants and the qonto
workload CCR. Gate, delivery, and revocation are unchanged.

tests/test_credential_change.py

@@ -67,6 +67,23 @@ class CredentialChangeTests(unittest.TestCase):
                 _ccr, errors, _warnings = credential_change.validate_ccr(path)
                 self.assertEqual(errors, [])
 
+    def test_qonto_workload_ccr_binds_rapp(self) -> None:
+        path = (
+            REPO_DIR
+            / "credential-change-requests/CCR-2026-0009-qonto-assistant-workload-kv-read.yaml"
+        )
+        ccr, errors, _warnings = credential_change.validate_ccr(path)
+        self.assertEqual(errors, [])
+        self.assertEqual(ccr["target"]["rapp"], "rapp-qonto")
+
+    def test_target_rapp_rejects_non_slug(self) -> None:
+        path = self.unapproved_ccr()
+        data = credential_change.load_yaml(path)
+        data["target"]["rapp"] = "qonto"
+        credential_change.dump_yaml(path, data)
+        _ccr, errors, _warnings = credential_change.validate_ccr(path)
+        self.assertTrue(any("target.rapp" in error for error in errors))
+
     def test_render_summary_contains_review_fields(self) -> None:
         ccr, _errors, warnings = credential_change.validate_ccr(self.sample)
         rendered = credential_change.render_summary(ccr, warnings)