Implement WP-0022 audit trail and WP-0023 INTENT–SCOPE closeout

Add unified metadata-only audit.jsonl with secret-material guard, instrument
sign/access/worker paths, and expose warden activity CLI. Surface broker hint
when VAULT_TOKEN is unset, refresh INTENT/SCOPE docs, and add production
integration checklists plus catalog lane promotion playbook.

wiki/playbooks/catalog-lane-promotion.md

@@ -0,0 +1,59 @@
+# Catalog Lane Promotion — draft → active
+
+Date: 2026-07-01  
+Workplan: WARDEN-WP-0023 T05
+
+`registry/routing/catalog.yaml` entries start as **`draft`** until an owner-confirmed
+concrete path exists. Draft lanes are hidden from default `warden route find` unless
+`--all` is passed.
+
+---
+
+## Promotion checklist
+
+Before changing `status: draft` → `status: active`:
+
+| # | Criterion | Evidence |
+| --- | --- | --- |
+| 1 | **Owner confirmed** | Owner repo workplan or State Hub note naming the lane ready |
+| 2 | **Concrete path** | Real OpenBao path, grant id, or exec command — no unresolved `<placeholders>` in the primary handoff |
+| 3 | **Playbook** | `wiki/playbooks/<id>.md` with `#worker-checklist` section |
+| 4 | **Exec routing** | `exec_owner` + native command **or** `exec_capable: true` with tested `warden access` proxy |
+| 5 | **Resolvable** | `warden route show <id> --json` shows `resolvable: true` when placeholders are documented |
+| 6 | **Tests** | Routing test or smoke proving lookup + handoff shape (no secret values in fixtures) |
+| 7 | **Review date** | Update `reviewed:` in catalog entry |
+
+Promotion PR touches: `registry/routing/catalog.yaml`, playbook, optional
+`tests/test_routing.py`, and a one-line note in `wiki/CredentialRouting.md` draft table.
+
+---
+
+## Worked example (already active)
+
+**`ops-warden-warden-sign-token`** — promoted 2026-07-01 after RAILIANCE-WP-0005:
+
+- Owner: `railiance-platform` credential broker
+- Concrete grant: `ops-warden/warden-sign`
+- Playbook: `wiki/playbooks/ops-warden-warden-sign-token.md`
+- Smoke: `make credential-exec-ops-warden-smoke`
+
+---
+
+## Draft lanes — none ready yet (2026-07-01)
+
+| Catalog `id` | Blocker |
+| --- | --- |
+| `issue-core-ingestion-api-key` | OpenBao KV path + ESO wiring not owner-signed off |
+| `openrouter-llm-connect` | activity-core secret mount path still placeholder |
+| `object-storage-sts` | NK-WP-0007 vending path not production-exercised |
+| `database-dynamic-credentials` | OpenBao database engine role paths TBD per workload |
+
+Re-run promotion when the owning repo closes the blocker; do not promote on
+playbook prose alone.
+
+---
+
+## See also
+
+- `wiki/CredentialRouting.md` — draft table index
+- `wiki/playbooks/ops-warden-warden-sign-token.md` — promotion reference