docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog

Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues
short-lived SSH certificates and routes every other credential need to the
subsystem that owns it — no desk metaphor, one execution lane.

- wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns
- registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1
  draft). No-double-source rule enforced structurally — authored steps/cert_command
  only on the warden_executes:true SSH entry; every wiki_ref anchor resolves
- wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note
- INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing;
  SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI
- WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

workplans/WARDEN-WP-0011-routing-guide-cli.md

@@ -11,6 +11,7 @@ planning_priority: high
 planning_order: 11
 created: "2026-06-18"
 updated: "2026-06-18"
+state_hub_workstream_id: "0a520f8e-01b4-48f1-9af3-2f3f69fd0672"
 ---
 
 # WARDEN-WP-0011 — Routing Lookup CLI
@@ -70,6 +71,7 @@ foreign subsystems. SSH precondition hints live inside `show` instead.
 id: WARDEN-WP-0011-T01
 status: todo
 priority: high
+state_hub_task_id: "55b8422c-ad3c-4084-9e00-acaa4c360906"
 ```
 
 - [ ] Add `src/warden/routing/` package: `models.py`, `catalog.py`.
@@ -83,6 +85,7 @@ priority: high
 id: WARDEN-WP-0011-T02
 status: todo
 priority: high
+state_hub_task_id: "60b679c5-79bd-4186-b5a6-ac576931f06c"
 ```
 
 - [ ] Register `route` Typer sub-app on the main CLI.
@@ -97,6 +100,7 @@ priority: high
 id: WARDEN-WP-0011-T03
 status: todo
 priority: high
+state_hub_task_id: "d307701f-0117-44f0-80fd-ca6f7ae06f42"
 ```
 
 - [ ] Tokenize query; match against `need_keywords`, `title`, `id`.
@@ -109,6 +113,7 @@ priority: high
 id: WARDEN-WP-0011-T04
 status: todo
 priority: high
+state_hub_task_id: "00a76e0f-8ab6-4f9a-ac6a-00eae633342c"
 ```
 
 - [ ] `tests/test_routing.py` — catalog load, no-double-source validation rejects a
@@ -122,6 +127,7 @@ priority: high
 id: WARDEN-WP-0011-T05
 status: todo
 priority: high
+state_hub_task_id: "bf848375-eca7-4116-bb1d-fb7df6395c70"
 ```
 
 - [ ] CI/test: every `wiki_ref` anchor resolves to an existing in-repo wiki section;