Add ops-warden-warden-sign-token routing lane for RAILIANCE-WP-0005 T08

Document the railiance-platform credential broker as the owner-native path
for scoped VAULT_TOKEN needs. Add catalog entry, playbook, and doc updates
so warden route find ranks the broker lane first; manual export remains a
documented fallback only.

wiki/playbooks/operator-openbao-token-hygiene.md

@@ -3,8 +3,33 @@
 Date: 2026-06-24  
 Workplan: WARDEN-WP-0013 T4
 
-Daily `warden sign` against production OpenBao requires a **scoped** API token in
-`VAULT_TOKEN` — not the cluster root token.
+Production `warden sign` against OpenBao needs a **scoped** `warden-sign` token in
+`VAULT_TOKEN` — not the cluster root token. Prefer the credential broker so you
+never paste or export the raw token manually.
+
+---
+
+## Preferred path (credential broker)
+
+Use the railiance-platform broker to mint a short-lived child token and inject it
+only into the command that needs it:
+
+```bash
+cd ~/railiance-platform
+make credential-exec-ops-warden-smoke   # policy-gate smoke, no manual VAULT_TOKEN
+
+# Or for a single sign:
+scripts/credential.py exec \
+  --grant ops-warden/warden-sign \
+  --purpose ops-warden-production-sign-smoke \
+  --ttl 15m -- \
+  warden sign <actor> --pubkey <path>
+```
+
+Routing: `warden route show ops-warden-warden-sign-token --json` · playbook:
+`wiki/playbooks/ops-warden-warden-sign-token.md`.
+
+ops-warden does not mint OpenBao tokens — the broker in `railiance-platform` does.
 
 ---
 
@@ -46,7 +71,10 @@ OpenBao admin runbooks).
 
 ---
 
-## Session pattern
+## Session pattern (manual fallback)
+
+Use only when the broker is unavailable and you already hold a scoped token
+out-of-band:
 
 ```bash
 # Set for current shell only — do not add to ~/.bashrc with a literal token
@@ -100,6 +128,7 @@ from daily shell profile.
 
 ## See also
 
+- `wiki/playbooks/ops-warden-warden-sign-token.md` — preferred broker path
 - `wiki/OpenBaoSshEngineChecklist.md`
 - `wiki/OpsWardenConfig.md` — Authentication section
 - `examples/warden.production.example.yaml`