Add routing catalog entry for reuse-surface hub write token.

REUSE_SURFACE_TOKEN is custody of the Railiance01 K8s secret reuse-surface-env,
not OpenBao. Workers blocked on hub register can now discover the lane via
warden route find and obtain it through the documented kubectl handoff.

registry/routing/catalog.yaml

@@ -214,6 +214,25 @@ entries:
     exec_capable: true
     lane: secret
 
+  - id: reuse-surface-hub-write-token
+    title: reuse-surface federation hub write bearer token
+    need_keywords: [reuse-surface, reuse_surface, hub, register, federation, write, token, bearer, REUSE_SURFACE_TOKEN, reuse.coulomb.social]
+    owner_repo: reuse-surface
+    subsystem: reuse-surface federation hub
+    warden_executes: false
+    wiki_ref: wiki/playbooks/reuse-surface-hub-write-token.md#worker-checklist
+    canon_ref: reuse-surface/specs/FederationHubAPI.md
+    reviewed: "2026-07-07"
+    status: active
+    # Concrete, owner-confirmed lane — REUSE-WP-0011 / RAILIANCE-WP-0007 (hub live
+    # 2026-06-15): token is the cluster Secret reuse-surface-env on Railiance01,
+    # not OpenBao. warden access proxies kubectl as the caller and never holds the value.
+    auth_method: "kubectl with Railiance01 kubeconfig (~/.kube/config-hosteurope)"
+    path_template: "reuse/reuse-surface-env"
+    fetch_command: "kubectl --kubeconfig ~/.kube/config-hosteurope get secret reuse-surface-env -n reuse -o jsonpath='{.data.REUSE_SURFACE_TOKEN}' | base64 -d"
+    exec_capable: true
+    lane: secret
+
   - id: openrouter-llm-connect
     title: OpenRouter API key for llm-connect in activity-core
     need_keywords: [openrouter, llm, llm-connect, api, key, activity-core, gemini, provider, openrouter_api_key]