docs: record whynot-design lane pointer discrepancy from ops-warden

ops-warden (WARDEN-WP-0037-T01) reported the whynot-design npm lane as
platform/workloads/coulomb/whynot-design/npm-publish, field NPM_AUTH_TOKEN.

Reviewed without any OpenBao read or mutation:
- The field claim conflates the injected env var (resolved by
  publication_policy) with the declared KV field (npm_token). Annotated the
  catalog so the distinction is explicit at the point of confusion.
- The path claim is credible but unresolved: hardening-backlog already names
  both locations, and custody is owned by railiance-platform. Catalog
  mount/path left unchanged pending custody-side confirmation rather than
  rewriting a proven production lane from an inbox claim.

Recorded under SECRETS-WP-0006-T06.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M65ovP3eiiPHubibvWs9mD

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 393550@bnt-lap001
Assistant-Session: 4bb359f9-1f12-4410-9e76-079cf23c82e4

catalog/whynot-design-npm-publish.yaml

@@ -22,6 +22,10 @@ mount: secret
 path: coulomb/whynot-design/npm/publish
 
 # Field(s) inside the KV entry. The publish token is stored under this key.
+# NOTE: this is the KV field name, NOT the env var the value is injected as.
+# The injected name is resolved separately by the publication-scope policy and
+# is currently `NPM_AUTH_TOKEN` (see delivery_config.npm.maturity below and
+# docs/publication-scope-policy.md). Do not conflate the two.
 fields:
   - npm_token