feat: admit existing OpenBao catalog lanes

catalog/forgejo-admin-api-token.yaml

@@ -0,0 +1,77 @@
+# NON-SECRET catalog metadata derived from railiance-platform CCR-2026-0006.
+id: forgejo-admin-api-token
+kind: kv
+org: coulomb
+repo: railiance-platform
+stage: prod
+description: >-
+  Forgejo site-admin PAT and non-secret companion metadata for attended operator
+  and automation tooling. This lane is distinct from Forgejo SMTP credentials.
+
+mount: platform
+path: workloads/forgejo/forgejo-admin
+mount_management: existing
+fields:
+  - API_TOKEN
+  - API_USER
+  - API_BASE_URL
+  - TOKEN_SCOPES
+  - GENERATED_AT
+
+consumers:
+  - name: forgejo-platform-operators
+    auth: oidc
+    claim: group:net-kingdom-admins
+    purpose: existing attended reads through forgejo-admin-workload-kv-read
+  - name: forgejo-automation
+    auth: approle
+    claim: catalog:forgejo-admin-api-token
+    purpose: approved package, repository, webhook, and bootstrap commands in a child process
+
+workload_delivery:
+  - mode: operator-oidc
+    owner: railiance-platform
+
+delivery_modes: [exec-env, read-check]
+delivery_auth:
+  method: approle
+  management: engine
+  # Avoid broad-admin name guards while retaining an exact-path read policy.
+  policy_name: se-prod-forgejo-operator-api-token
+  role_name: se-prod-forgejo-operator-api-token
+  token_ttl: 15m
+  token_max_ttl: 30m
+  secret_id_ttl: 15m
+  secret_id_num_uses: 1
+  token_num_uses: 8
+
+approval:
+  model: ccr
+  decision_ref: CCR-2026-0006
+  notes: >-
+    CCR-2026-0006 approves the existing OIDC/operator lane. A live native
+    AppRole apply remains gated by SECRETS-WP-0006-T05 review and operator approval.
+
+verification:
+  positive: approved delivery AppRole can read declared fields and an exec smoke authenticates to Forgejo
+  negative: unrelated token is denied on platform/data/workloads/forgejo/forgejo-admin
+
+risk:
+  classification: high
+  notes: API_TOKEN is a Forgejo site-admin PAT with package, repository, webhook, and operator impact
+
+rotation:
+  owner: railiance-platform + Forgejo operator
+  expectation: >-
+    Mint a replacement PAT as the site-admin account, update OpenBao, verify all
+    consumers through exec delivery, then delete the old PAT in Forgejo.
+  ttl: provider-defined
+
+deactivation:
+  owner: railiance-platform + Forgejo operator
+  expectation: >-
+    Disable the front door, detach native/OIDC read access, revoke the PAT in
+    Forgejo, and preserve package/webhook audit evidence.
+
+audit:
+  evidence: CCR id, actor, exact path, field names, Forgejo token identifier/scopes if non-secret, timestamps, and pass/fail only