Add credential approval workflow plan

openbao/policies/workload-kv-read-whynot-design-npm-publish.hcl

@@ -0,0 +1,13 @@
+# Least-privilege read policy for the whynot-design npm publish token.
+#
+# This policy intentionally grants only read access to the single KV-v2 secret
+# path used by ops-warden's caller-scoped access lane. It does not grant list
+# access to sibling workloads or mutation capabilities.
+
+path "platform/data/workloads/whynot-design/whynot-design/npm-publish" {
+  capabilities = ["read"]
+}
+
+path "platform/metadata/workloads/whynot-design/whynot-design/npm-publish" {
+  capabilities = ["read"]
+}