Prepare WP-0006 first-lane native cutover packet

Re-render admitted-lane plans as kv-mount-check plus exact-path AppRole.
Name openrouter-llm-connect as the first candidate. Document apply,
verify, and rollback without authorizing live mutation. T05 stays wait
on T04 serving and attended authority.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

tests/test_wp0006_cutover.py

@@ -0,0 +1,31 @@
+from secrets_engine.catalog import load_catalog
+from secrets_engine.config import repo_root
+from secrets_engine.plan import build_plan
+
+ADMITTED = (
+    "openrouter-llm-connect",
+    "email-connect-transactional",
+    "issue-core-ingestion-api-key",
+    "reuse-surface-hub-write-token",
+    "forgejo-admin-api-token",
+)
+FIRST_LANE = "openrouter-llm-connect"
+
+
+def test_admitted_lanes_plan_existing_mount_and_exact_approle():
+    catalog = load_catalog(repo_root() / "catalog")
+    assert FIRST_LANE == ADMITTED[0]
+    for lane_id in ADMITTED:
+        entry = catalog[lane_id]
+        assert entry.stage == "prod"
+        assert entry.mount == "platform"
+        assert entry.mount_management == "existing"
+        plan = build_plan(entry, "prod", decision_id=entry.approval.get("decision_ref", ""))
+        kinds = [action.kind for action in plan.actions]
+        assert kinds[0] == "kv-mount-check"
+        assert "kv-mount" not in kinds
+        assert "policy" in kinds
+        assert "approle" in kinds
+        assert "platform/data/" in plan.policy_hcl
+        assert '"create"' not in plan.policy_hcl
+        assert "capabilities = [\"read\"]" in plan.policy_hcl