feat(WARDEN-WP-0018): activate whynot-design npm publish lane + resolvable flag

railiance-platform finished provisioning the whynot-design npm publish lane
(CCR-2026-0001, commit 8f617fc: active, readiness=ready, resolvable=true, positive
fetch + negative denial verified). First concrete warden access --fetch-resolvable
non-SSH lane — end-to-end proof of the WP-0014 conduit + WP-0017 discoverability.

T1 — catalog entry whynot-design-npm-publish (active, exec_capable) with the
owner-confirmed zero-placeholder handoff: path platform/workloads/coulomb/whynot-design/
npm-publish (the superseded whynot-design/whynot-design/... form is not used), field
NPM_AUTH_TOKEN, OIDC role whynot-design-workload-kv-read, policy + flex-auth ref. Added
wiki/playbooks/whynot-design-npm-publish.md.

T2 — RouteEntry.resolvable (active + exec_capable + no <…> placeholder), surfaced in
route/access --json; Catalog.find resolves an exact catalog-id first so
`warden access whynot-design-npm-publish` is deterministic. Tests added; fixed a
no-match test query that substring-collided (no ⊂ whynot). 213 pass, lint clean.

T3 — notified whynot-design (zero-placeholder command + resolvable gate + path
correction) and confirmed activation to railiance-platform. Sibling lanes stay draft
per their deferral.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_routing.py

@@ -76,6 +76,29 @@ def test_real_catalog_has_one_executed_lane():
     assert [e.id for e in executed] == ["ssh-cert-host-access"]
 
 
+def test_whynot_design_npm_lane_is_concrete_and_resolvable():
+    """The provisioned npm publish lane has no placeholders and reports resolvable."""
+    catalog = load_catalog(_repo_catalog())
+    e = catalog.get("whynot-design-npm-publish")
+    assert e is not None and e.is_active and e.exec_capable
+    assert e.resolvable is True
+    assert "<" not in e.fetch_command and ">" not in e.fetch_command
+    assert "platform/workloads/coulomb/whynot-design/npm-publish" in e.fetch_command
+
+
+def test_generic_and_template_lanes_not_resolvable():
+    catalog = load_catalog(_repo_catalog())
+    # generic openbao lane has <FIELD>/<path_template>; login lane has <domain>.
+    assert catalog.get("openbao-api-key").resolvable is False
+    assert catalog.get("key-cape-oidc-login").resolvable is False
+
+
+def test_find_exact_id_wins_over_keyword_collision():
+    catalog = load_catalog(_repo_catalog())
+    # "npm" alone collides with openbao-api-key; the exact id must resolve uniquely.
+    assert catalog.find("whynot-design-npm-publish", limit=1)[0].id == "whynot-design-npm-publish"
+
+
 def test_no_double_source_rule_rejects_routed_steps(tmp_path):
     bad = dict(ROUTED_ENTRY)
     bad["steps"] = ["do a thing on OpenBao"]  # non-SSH entry must not carry steps