NET-WP-0020 finished: attended-ceremony + auto-unseal-transit profiles, greenfield init/unseal proof

T2: greenfield live proof against a fresh uninitialized OpenBao 2.5.5 —
caught and fixed 'bao operator unseal -' not reading stdin (now
'bao write sys/unseal key=-'); init and reseal-replay paths proven.
T3: attended-ceremony selectable — runbook, non-secret ceremony-record
template + validator, and a lab/production deployment profile that blocks
sops-held-automation in console selection, gates, and the init script.
T4: console gate + evidence flags for auto-unseal-transit (Helm seal stanza
prepared in railiance-platform).
Also: SCOPE.md refreshed to current repo state; adhoc fix for the broken
check-secrets Make target (unescaped $).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

workplans/ADHOC-2026-07-02.md

@@ -33,3 +33,18 @@ recipient and a clear notice instead of dying; live runs without a key still
 fail hard. Verified: full `--dry-run` now traverses Phase 0 through Phase 10
 including the new Phase 7b OpenBao hook (NET-WP-0020-T02) on a machine with
 no age key.
+
+## Fix broken check-secrets Make target (unescaped `$`)
+
+```task
+id: ADHOC-2026-07-02-T02
+status: done
+priority: medium
+```
+
+`make check-secrets` failed with a bash parse error ("unexpected EOF while
+looking for matching `'`"): the trailing `grep -v '/$'` used a single `$`,
+which make expanded before bash saw it. Escaped to `$$`. Verified:
+`make check-secrets` passes again ("All secrets/ files appear SOPS-encrypted").
+Pre-existing bug, unrelated to NET-WP-0020; found while running the final
+checks for that workplan.