feat(WP-0011): warden route lookup CLI over the pointer catalog

Add a read-only `warden route` command group (list/show/find) that reads
registry/routing/catalog.yaml and tells a worker which subsystem owns a need
and which wiki/canon doc to follow. ops-warden still executes exactly one lane
(SSH); routed entries return a pointer and never call any subsystem.

- src/warden/routing/: models.py + catalog.py loader; enforces the
  no-double-source rule (non-SSH entries with steps/cert_command fail validation),
  dup-id and schema checks.
- route list (active-only unless --all, --tag), route show (SSH appends steps +
  cert pattern; routed ends with "next action on <owner> — see <wiki_ref>"),
  route find (keyword ranking, --json).
- tests/test_routing.py: load/validation, find ranking, CLI JSON shapes, plus a
  drift guard (every wiki_ref anchor resolves; every entry has a reviewed date).
- Docs: wiki/AccessRouting.md CLI section, README quick reference, SCOPE A3 -> A4.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

workplans/WARDEN-WP-0011-routing-guide-cli.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Routing Lookup CLI"
 domain: custodian
 repo: ops-warden
-status: ready
+status: done
 owner: codex
 topic_slug: custodian
 planning_priority: high
@@ -69,72 +69,72 @@ foreign subsystems. SSH precondition hints live inside `show` instead.
 
 ```task
 id: WARDEN-WP-0011-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "55b8422c-ad3c-4084-9e00-acaa4c360906"
 ```
 
-- [ ] Add `src/warden/routing/` package: `models.py`, `catalog.py`.
-- [ ] Load and validate `registry/routing/catalog.yaml`.
-- [ ] Enforce the no-double-source rule: non-SSH entries with a `steps` block are a
+- [x] Add `src/warden/routing/` package: `models.py`, `catalog.py`.
+- [x] Load and validate `registry/routing/catalog.yaml`.
+- [x] Enforce the no-double-source rule: non-SSH entries with a `steps` block are a
       validation error. Clear errors for missing file, schema violations, dup `id`.
 
 ### T2 — `warden route list` and `show`
 
 ```task
 id: WARDEN-WP-0011-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "60b679c5-79bd-4186-b5a6-ac576931f06c"
 ```
 
-- [ ] Register `route` Typer sub-app on the main CLI.
-- [ ] `list` — Rich table + `--json` array of summaries; active-only unless `--all`.
-- [ ] `show` — owner, prerequisites, pointers (`wiki_ref`, `canon_ref`),
+- [x] Register `route` Typer sub-app on the main CLI.
+- [x] `list` — Rich table + `--json` array of summaries; active-only unless `--all`.
+- [x] `show` — owner, prerequisites, pointers (`wiki_ref`, `canon_ref`),
       `warden_executes`, anti-patterns; SSH entries also append `steps` + cert pattern.
-- [ ] Exit 1 with a `find` hint when `show` id is unknown.
+- [x] Exit 1 with a `find` hint when `show` id is unknown.
 
 ### T3 — `warden route find`
 
 ```task
 id: WARDEN-WP-0011-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "d307701f-0117-44f0-80fd-ca6f7ae06f42"
 ```
 
-- [ ] Tokenize query; match against `need_keywords`, `title`, `id`.
-- [ ] Rank, show top matches (default 5); `--json` for agents.
-- [ ] Fixtures: "issue core api key", "ssh tunnel", "openrouter key".
+- [x] Tokenize query; match against `need_keywords`, `title`, `id`.
+- [x] Rank, show top matches (default 5); `--json` for agents.
+- [x] Fixtures: "issue core api key", "ssh tunnel", "openrouter key".
 
 ### T4 — Tests
 
 ```task
 id: WARDEN-WP-0011-T04
-status: todo
+status: done
 priority: high
 state_hub_task_id: "00a76e0f-8ab6-4f9a-ac6a-00eae633342c"
 ```
 
-- [ ] `tests/test_routing.py` — catalog load, no-double-source validation rejects a
+- [x] `tests/test_routing.py` — catalog load, no-double-source validation rejects a
       non-SSH `steps` block, find ranking, show JSON shape, SSH `show` includes cert
       pattern.
-- [ ] No integration test requires a live subsystem.
+- [x] No integration test requires a live subsystem.
 
 ### T5 — Doc consistency + drift guard
 
 ```task
 id: WARDEN-WP-0011-T05
-status: todo
+status: done
 priority: high
 state_hub_task_id: "bf848375-eca7-4116-bb1d-fb7df6395c70"
 ```
 
-- [ ] CI/test: every `wiki_ref` anchor resolves to an existing in-repo wiki section;
+- [x] CI/test: every `wiki_ref` anchor resolves to an existing in-repo wiki section;
       every entry has a `reviewed` date.
-- [ ] `wiki/AccessRouting.md` — CLI section with agent-oriented examples.
-- [ ] README — `warden route --help` quick reference.
-- [ ] Bump SCOPE availability note A3 → A4 on ship.
+- [x] `wiki/AccessRouting.md` — CLI section with agent-oriented examples.
+- [x] README — `warden route --help` quick reference.
+- [x] Bump SCOPE availability note A3 → A4 on ship.
 
 ---