Finish SAND-WP-0002: remote smoke, podman-compose, HTTP stub

- T10 smoke passed on CoulombCore (sand-boxer self-deploy, sandbox 4e542c51)
- Add e2e smoke compose, scripts/smoke-compose-e2e.sh, make smoke-remote
- Support SANDBOXER_COMPOSE_CMD for podman-compose hosts
- FastAPI v0 stub at sandboxer.api.app; migration gaps doc
- Mark workplan finished (all 10 tasks done)

workplans/SAND-WP-0002-meta-framework-foundation.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Meta-framework foundation and first extension"
 domain: infotech
 repo: sand-boxer
-status: active
+status: finished
 owner: codex
 topic_slug: custodian
 created: "2026-06-22"
-updated: "2026-06-22"
+updated: "2026-06-23"
 state_hub_workstream_id: "1cdfc6ba-6cd2-4d10-a78f-8fa5996ad567"
 ---
 
@@ -216,7 +216,7 @@ state_hub_task_id: "e2b089b2-3742-4feb-86c3-788a1f6ffb81"
 
 ```task
 id: SAND-WP-0002-T10
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "a95755fb-cda6-4741-847c-78ef7e073cab"
 ```
@@ -234,8 +234,9 @@ End-to-end proof on CoulombCore or sandboxer01 (when reachable):
 Record gaps for wise-validator migration (SAND-WP-0003) and `the-custodian`
 shim (SAND-WP-0004).
 
-Runbook published at `docs/runbooks/profile-compose-e2e.md`. Remote host smoke
-test (steps 1–4) pending operator run against CoulombCore/sandboxer01.
+Remote smoke passed on CoulombCore (`92.205.130.254`, `podman-compose`):
+`sandbox_id=4e542c51` via `./scripts/smoke-compose-e2e.sh` (2026-06-23).
+Migration gaps recorded in `docs/migration-gaps.md`.
 
 ---
 

workplans/SAND-WP-0008-host-telemetry-and-self-canary.md

@@ -9,6 +9,7 @@ owner: codex
 topic_slug: custodian
 created: "2026-06-23"
 updated: "2026-06-23"
+state_hub_workstream_id: "afbcbc84-5ec7-4f8b-ae21-4cbda0d05195"
 ---
 
 # Host telemetry and self-canary introspection
@@ -43,6 +44,7 @@ later).
 id: SAND-WP-0008-T01
 status: todo
 priority: high
+state_hub_task_id: "8f7b46e3-045e-481c-81bd-1c61734c6eb3"
 ```
 
 Author `docs/host-telemetry.md` defining:
@@ -64,6 +66,7 @@ does not own long-term metrics DB).
 id: SAND-WP-0008-T02
 status: todo
 priority: high
+state_hub_task_id: "732bae4e-2dd9-4500-a86d-e869007bb383"
 ```
 
 Add:
@@ -85,6 +88,7 @@ Canary deliverable on `ready`: JSON `IntrospectionReport` in sandbox status
 id: SAND-WP-0008-T03
 status: todo
 priority: high
+state_hub_task_id: "7bd22f27-5058-4c19-98b6-b923909a8815"
 ```
 
 SSH-side collection (shell + structured parse, no extra daemon on host):
@@ -103,6 +107,7 @@ command output.
 id: SAND-WP-0008-T04
 status: todo
 priority: high
+state_hub_task_id: "c2d19bb7-9322-4744-a71e-75f7701a6fb2"
 ```
 
 Scan remote host for:
@@ -121,6 +126,7 @@ No automatic deletion in this task — dry-run only.
 id: SAND-WP-0008-T05
 status: todo
 priority: medium
+state_hub_task_id: "b6b02289-d36e-4ee1-9ff7-dc59a1d24886"
 ```
 
 Integrate into `SandboxManager.create` / `destroy` when profile metadata requests
@@ -139,6 +145,7 @@ Same pattern on `destroy` for teardown impact. Tests mock SSH collector.
 id: SAND-WP-0008-T06
 status: todo
 priority: high
+state_hub_task_id: "d9941d93-a662-45c0-820b-88d32266c653"
 ```
 
 When `create` has no `repo` input:
@@ -163,6 +170,7 @@ sandboxer create --input repo=/other/repo     # unchanged behavior
 id: SAND-WP-0008-T07
 status: todo
 priority: high
+state_hub_task_id: "76430452-c98e-44e5-b625-e243dc12b8a5"
 ```
 
 After `wait_ready` for canary profile:
@@ -179,6 +187,7 @@ After `wait_ready` for canary profile:
 id: SAND-WP-0008-T08
 status: todo
 priority: medium
+state_hub_task_id: "4ee4b95b-e7b5-4893-b78e-914f808bc00a"
 ```
 
 Emit structured telemetry to:
@@ -200,6 +209,7 @@ activity-core may schedule periodic canary runs later — out of scope here.
 id: SAND-WP-0008-T09
 status: todo
 priority: medium
+state_hub_task_id: "6ea8eda6-491b-460a-a526-7565962f449e"
 ```
 
 ```bash
@@ -217,6 +227,7 @@ sandboxer reap-stale --apply [--older-than 24h] # T10+; gated behind --apply
 id: SAND-WP-0008-T10
 status: todo
 priority: medium
+state_hub_task_id: "435a3993-d8d3-4280-b68a-c37e34d20312"
 ```
 
 - `docs/runbooks/profile-sandbox-canary.md`