Complete WARDEN-WP-0012 routing scenario playbooks

Add platform-secret playbooks for issue-core ingestion, OpenRouter llm-connect,
object-storage STS, and database dynamic credentials. Extend the routing catalog
with draft entries and implement `warden route list --stale` for quarterly drift
review. Document the review cadence in AccessRouting and mark the workplan finished.

tests/test_routing.py

@@ -11,8 +11,10 @@ import yaml
 from typer.testing import CliRunner
 
 from warden.cli import app
+from datetime import date
+
 from warden.routing import CatalogError, load_catalog
-from warden.routing.catalog import find_catalog_path
+from warden.routing.catalog import days_since_review, find_catalog_path, is_review_stale
 
 runner = CliRunner()
 
@@ -130,6 +132,41 @@ def test_find_ssh_tunnel_top_match():
     assert matches and matches[0].id == "ops-bridge-tunnel"
 
 
+def test_find_openrouter_key():
+    catalog = load_catalog(_repo_catalog())
+    matches = catalog.find("openrouter api key", include_draft=True)
+    assert matches and matches[0].id == "openrouter-llm-connect"
+
+
+def test_find_object_storage_sts():
+    catalog = load_catalog(_repo_catalog())
+    matches = catalog.find("s3 temporary credentials", include_draft=True)
+    assert matches and matches[0].id == "object-storage-sts"
+
+
+# ---------------------------------------------------------------------------
+# Review staleness
+# ---------------------------------------------------------------------------
+
+def test_days_since_review():
+    assert days_since_review("2026-06-01", today=date(2026, 6, 24)) == 23
+
+
+def test_is_review_stale_past_threshold():
+    assert is_review_stale("2026-01-01", threshold_days=90, today=date(2026, 6, 24))
+
+
+def test_is_review_stale_within_threshold():
+    assert not is_review_stale("2026-06-01", threshold_days=90, today=date(2026, 6, 24))
+
+
+def test_catalog_stale_filters_entries():
+    catalog = load_catalog(_repo_catalog())
+    stale = catalog.stale(threshold_days=0, today=date(2026, 6, 25))
+    assert stale
+    assert all(e.reviewed <= "2026-06-24" for e in stale)
+
+
 # ---------------------------------------------------------------------------
 # CLI (uses the repo catalog via env override)
 # ---------------------------------------------------------------------------
@@ -181,6 +218,34 @@ def test_cli_find_json(repo_catalog_env):
     assert "ops-bridge-tunnel" in ids
 
 
+def test_cli_list_stale_json(repo_catalog_env):
+    result = runner.invoke(
+        app, ["route", "list", "--stale", "--stale-days", "1", "--json"]
+    )
+    assert result.exit_code == 0
+    data = json.loads(result.stdout)
+    assert data
+    assert all("days_since_review" in row for row in data)
+    assert all(row["stale_threshold_days"] == 1 for row in data)
+
+
+def test_cli_list_stale_empty_with_high_threshold(repo_catalog_env):
+    result = runner.invoke(
+        app, ["route", "list", "--stale", "--stale-days", "9999"]
+    )
+    assert result.exit_code == 0
+    assert "No stale" in result.output
+
+
+def test_cli_find_openrouter_draft_only_with_all(repo_catalog_env):
+    result = runner.invoke(
+        app, ["route", "find", "openrouter api key", "--all", "--json"]
+    )
+    assert result.exit_code == 0
+    ids = [e["id"] for e in json.loads(result.stdout)]
+    assert "openrouter-llm-connect" in ids
+
+
 # ---------------------------------------------------------------------------
 # T5 drift guard — every wiki_ref anchor resolves, every entry has a reviewed date
 # ---------------------------------------------------------------------------