feat(WARDEN-WP-0018): activate whynot-design npm publish lane + resolvable flag

railiance-platform finished provisioning the whynot-design npm publish lane
(CCR-2026-0001, commit 8f617fc: active, readiness=ready, resolvable=true, positive
fetch + negative denial verified). First concrete warden access --fetch-resolvable
non-SSH lane — end-to-end proof of the WP-0014 conduit + WP-0017 discoverability.

T1 — catalog entry whynot-design-npm-publish (active, exec_capable) with the
owner-confirmed zero-placeholder handoff: path platform/workloads/coulomb/whynot-design/
npm-publish (the superseded whynot-design/whynot-design/... form is not used), field
NPM_AUTH_TOKEN, OIDC role whynot-design-workload-kv-read, policy + flex-auth ref. Added
wiki/playbooks/whynot-design-npm-publish.md.

T2 — RouteEntry.resolvable (active + exec_capable + no <…> placeholder), surfaced in
route/access --json; Catalog.find resolves an exact catalog-id first so
`warden access whynot-design-npm-publish` is deterministic. Tests added; fixed a
no-match test query that substring-collided (no ⊂ whynot). 213 pass, lint clean.

T3 — notified whynot-design (zero-placeholder command + resolvable gate + path
correction) and confirmed activation to railiance-platform. Sibling lanes stay draft
per their deferral.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

workplans/WARDEN-WP-0017-access-front-door-discoverability.md

@@ -11,6 +11,7 @@ planning_priority: high
 planning_order: 17
 created: "2026-06-27"
 updated: "2026-06-27"
+state_hub_workstream_id: "cf8b392e-7624-4585-8935-a85e29202935"
 ---
 
 # WARDEN-WP-0017 — Access front-door discoverability
@@ -55,6 +56,7 @@ tracked separately); any new fetch capability (the proxy already exists).
 id: WARDEN-WP-0017-T01
 status: done
 priority: high
+state_hub_task_id: "6e98df42-b5b4-49f8-a444-3c6346c8abd7"
 ```
 
 - [x] `warden route` table: three-valued `warden` column — `issue` / `assist`
@@ -73,6 +75,7 @@ priority: high
 id: WARDEN-WP-0017-T02
 status: done
 priority: high
+state_hub_task_id: "6e2a7067-1afc-4f38-8d99-4d5c36a4661c"
 ```
 
 - [x] `.claude/rules/credential-routing.md`: reframed the lead ("issues SSH certs **and**
@@ -88,6 +91,7 @@ priority: high
 id: WARDEN-WP-0017-T03
 status: done
 priority: medium
+state_hub_task_id: "7199625b-e78e-4495-8ca0-076100ae9f08"
 ```
 
 - [x] Registered the State Hub capability "Operator access front door (caller-identity