fix(cli): bundle registry into wheel so installed warden works outside the repo

issue-core flagged the installed `warden` lacked the `route` subcommand. Two causes:

1. uv reused a cached wheel (version stayed 0.1.0) so the installed warden.cli was
   stale. Documented the cache-clean + --reinstall fix in ADHOC-2026-06-27.
2. Even rebuilt, route/access/policy were unusable outside a checkout because the
   routing catalog + posture descriptors live in registry/ at repo root, outside the
   package. Bundle registry/ into the wheel (hatch force-include -> warden/_registry)
   and add a packaged-data fallback in find_catalog_path / find_posture_path after the
   repo walk, so source runs still prefer the repo's registry/ (single source of truth).

Verified `warden route list` / `warden policy list` work from /tmp. 200 tests, lint clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pyproject.toml

@@ -20,6 +20,13 @@ ops-ssh-wrapper = "warden.scripts.ops_ssh_wrapper:main"
 [tool.hatch.build.targets.wheel]
 packages = ["src/warden"]
 
+# Bundle the routing catalog + posture descriptors inside the package so the
+# installed CLI (`warden route` / `access` / `policy`) works from any cwd, not only
+# from a checkout. Source runs still prefer the repo's registry/ (single source of
+# truth); the bundled copy is the fallback resolved by find_catalog_path/find_posture_path.
+[tool.hatch.build.targets.wheel.force-include]
+"registry" = "warden/_registry"
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 pythonpath = ["src"]