Record platform-operator approval, delegated policy/OIDC role apply, negative verification evidence, and add attended PAT provision script.
Establish proposed workload-kv-read custody for the Forgejo site-admin PAT at platform/workloads/forgejo/forgejo-admin, sibling to forgejo-mailer. OIDC workstation fetch mirrors the railiance-backup-offsite pattern.
