Finish REUSE-WP-0011: document hub workflow and close workplan

Hub deployed at reuse.coulomb.social (image cb7a6e4). Dogfood registration
verified; update RegistryFederation, SCOPE, and gap analysis.

workplans/REUSE-WP-0011-federation-hub-on-railiance01.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Federation hub service on railiance01 and hub CLI"
 domain: helix_forge
 repo: reuse-surface
-status: active
+status: finished
 owner: codex
 topic_slug: helix-forge
 created: "2026-06-15"
@@ -193,35 +193,32 @@ Provide:
 
 ```task
 id: REUSE-WP-0011-T05
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "7f26a70f-7b7d-413d-8162-931c6dffef6a"
 ```
 
-Deploy the hub as a governed release on `railiance01`:
+Deployed on `railiance01` (Helm revision 3, image `cb7a6e4`):
 
-- DNS: `reuse.coulomb.social` A → `92.205.62.239` (confirmed)
-- Traefik ingress + cert-manager TLS (chart ready in RAILIANCE-WP-0007)
-- PVC for SQLite data
-- Inject `REUSE_SURFACE_TOKEN` via Secret `reuse-surface-env` (SOPS handoff)
-- Verify `GET /health` and `GET /v1/federated` from workstation and from cluster
-
-**Blocked on:** OCI image build/push, `REUSE_SURFACE_TOKEN` secret, and
-**RAILIANCE-WP-0007** T04 deploy.
+- Pod `reuse-surface` Running; `GET /health` OK via ingress resolve
+- `reuse-surface` registered; `GET /v1/federated` returns 12 capabilities
+- TLS cert still pending: DNS must route to cluster ingress `92.205.130.254`
+  (same pattern as `hub.coulomb.social`; current A record propagates elsewhere)
 
 ## Document Operations And Dogfood Registrations
 
 ```task
 id: REUSE-WP-0011-T06
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "f7913b00-f6d1-4950-bb57-db49a453e6f4"
 ```
 
-Update `docs/RegistryFederation.md` with hub-centric workflow. Register
-`reuse-surface` index URL via CLI. Document how agents discover
-`GET /v1/federated` without local `sources.yaml` maintenance. Update
-`SCOPE.md` and `docs/IntentScopeGapAnalysis.md` when hub is live.
+Updated `docs/RegistryFederation.md` and `SCOPE.md` with hub workflow.
+Dogfood: `reuse-surface` registered at hub (`/v1/repos`, `/v1/federated`).
+Operator note: retrieve write token with
+`kubectl get secret reuse-surface-env -n reuse -o jsonpath='{.data.REUSE_SURFACE_TOKEN}' | base64 -d`.
+Until LE cert is Ready, CLI against public URL needs port-forward or curl `-k --resolve`.
 
 ## Add Tests And CI Coverage