Migrate reuse-surface hub token lane to OpenBao handoff

RAILIANCE-WP-0011-T03: point reuse-surface-hub-write-token catalog,
playbook, and tests at bao kv get on platform/workloads/reuse/reuse-surface/runtime-secrets;
kubectl documented as break-glass only.

tests/test_proxy.py

@@ -64,16 +64,16 @@ def test_resolve_refuses_non_exec_capable():
         resolve_fetch_command(_entry(exec_capable=False, fetch_command=None))
 
 
-def test_resolve_piped_fetch_uses_shell_cmd():
+def test_resolve_bao_fetch_uses_argv():
     from warden.routing import load_catalog
 
     catalog = load_catalog(Path(__file__).resolve().parents[1] / "registry" / "routing" / "catalog.yaml")
     entry = catalog.get("reuse-surface-hub-write-token")
     resolved = resolve_fetch_command(entry)
-    assert resolved.argv is None
-    assert resolved.shell_cmd is not None
-    assert "| base64 -d" in resolved.shell_cmd
-    assert "reuse-surface-env" in resolved.shell_cmd
+    assert resolved.argv is not None
+    assert resolved.shell_cmd is None
+    assert resolved.argv[0] == "bao"
+    assert "platform/workloads/reuse/reuse-surface/runtime-secrets" in resolved.argv
 
 
 # --- G2: transit-only fetch (inherited stdout) -----------------------------

tests/test_routing.py

@@ -288,8 +288,8 @@ def test_reuse_surface_hub_write_token_lane_is_resolvable():
     e = catalog.get("reuse-surface-hub-write-token")
     assert e is not None and e.is_active and e.exec_capable
     assert e.resolvable is True
-    assert e.owner_repo == "reuse-surface"
-    assert "reuse-surface-env" in e.fetch_command
+    assert e.owner_repo == "railiance-platform"
+    assert "platform/workloads/reuse/reuse-surface/runtime-secrets" in e.fetch_command
 
 
 def test_find_object_storage_sts():