Add draft catalog lane for railiance backup offsite credentials.

Points at CCR-2026-0004 OpenBao path; playbook documents bao login and
fetch shapes for railiance-backup and forgejo-backup tooling.

registry/routing/catalog.yaml

@@ -257,6 +257,24 @@ entries:
     exec_capable: true
     lane: secret
 
+  - id: railiance-backup-offsite-lane
+    title: Railiance offsite backup Nextcloud WebDAV credentials
+    need_keywords: [railiance, backup, nextcloud, webdav, offsite, age, forgejo-backup, NC_WEBDAV_TOKEN, file drop]
+    owner_repo: railiance-platform
+    subsystem: OpenBao + Nextcloud
+    warden_executes: false
+    wiki_ref: wiki/playbooks/railiance-backup-offsite-lane.md#worker-checklist
+    canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
+    reviewed: "2026-07-07"
+    status: draft
+    # CCR-2026-0004: policy + OIDC role applied; values provisioned 2026-07-07.
+    # Promote to active after positive/negative caller verification.
+    auth_method: "caller's own OpenBao token (OIDC netkingdom role railiance-backup-workload-kv-read)"
+    path_template: "platform/workloads/railiance/backup/offsite-lane"
+    fetch_command: "bao kv get -field=<FIELD> platform/workloads/railiance/backup/offsite-lane"
+    exec_capable: true
+    lane: secret
+
   # --- draft: owner path not yet shipped; hidden from default lookup ---
 
   - id: object-storage-sts