finish(CUST-WP-0054): workstation independence engineering closeout

Complete T04–T08: bulk Forgejo remote_url migration for all registered
repos, phase 5 stabilization tooling, dev-hub beachhead artifacts, and
phoenix drill runbook. Archive workplan with T09/T10 as operator gates.

tools/cancel-duplicate-hub-tasks.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Cancel duplicate CUST-WP-0054 hub tasks created during 2026-07-07 workstream recreation.
+set -euo pipefail
+
+API_BASE="${API_BASE:-http://127.0.0.1:8000}"
+
+DUPLICATES=(
+  ced0f63b-2af0-452e-95e0-76a74637a7a5
+  2d05e885-8d97-4fd7-9736-dadae91c81a4
+  0f0f9e53-8e99-4ace-a8ca-6dcd4df387e7
+  47a0526d-17b9-4e46-ad41-c3d7b71d06f1
+  4c6f8cd8-4b7b-40ee-9c1c-633d251f4e6b
+  47385d99-b09c-4e40-8836-f09061d45ee1
+  5ca2d557-c352-401d-89d7-f204fd3ebb4b
+  34d93dbc-08f6-4182-803d-0f60ceddcbea
+  b2ddee15-10df-4fe8-9955-f3b653b8f529
+  5d02c7af-f4e8-494a-b0fe-9d7c21573ce3
+)
+
+for id in "${DUPLICATES[@]}"; do
+  http=$(curl -sS -o /tmp/task-patch.json -w '%{http_code}' \
+    -X PATCH "${API_BASE}/tasks/${id}" \
+    -H "Content-Type: application/json" \
+    -d '{"status":"cancel","intervention_note":"Duplicate from 2026-07-07 workstream recreation; canonical task retained in workplan."}')
+  if [[ "$http" == "200" ]]; then
+    echo "CANCEL ${id}"
+  elif [[ "$http" == "404" ]]; then
+    echo "SKIP  ${id} (not found)"
+  else
+    echo "FAIL  ${id} http=${http}" >&2
+    cat /tmp/task-patch.json >&2
+  fi
+done

tools/patch-forgejo-remote-urls.sh

@@ -21,8 +21,23 @@ if [[ "${1:-}" == "--tier-25" ]]; then
   set -- "${TIER_25[@]}"
 fi
 
+if [[ "${1:-}" == "--all-gitea" ]]; then
+  mapfile -t SLUGS < <(curl -fsS "${API_BASE}/repos/" | python3 -c "
+import json,sys
+for r in json.load(sys.stdin):
+    url = r.get('remote_url') or ''
+    if 'gitea-remote' in url or 'gitea.coulomb.social' in url:
+        print(r['slug'])
+")
+  if [[ ${#SLUGS[@]} -eq 0 ]]; then
+    echo "No gitea-remote repos found in hub"
+    exit 0
+  fi
+  set -- "${SLUGS[@]}"
+fi
+
 if [[ $# -lt 1 ]]; then
-  echo "usage: $0 slug [slug ...] | --tier-25" >&2
+  echo "usage: $0 slug [slug ...] | --tier-25 | --all-gitea" >&2
   exit 1
 fi
 

tools/phoenix-drill.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Dry-run phoenix machine drill — composes existing bootstrap pieces (CUST-WP-0054-T08).
+set -euo pipefail
+
+MODE="${1:-check}"
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+usage() {
+  cat <<'USAGE'
+Usage: phoenix-drill.sh [check|plan]
+
+  check — verify required repos, Make targets, and runbooks exist
+  plan  — print ordered drill steps without executing destructive actions
+USAGE
+}
+
+step_ok() { printf '  [ok] %s\n' "$*"; }
+step_miss() { printf '  [missing] %s\n' "$*"; }
+
+check_paths() {
+  local label="$1"
+  local path="$2"
+  if [[ -e "$path" ]]; then
+    step_ok "$label → $path"
+    return 0
+  fi
+  step_miss "$label → $path"
+  return 1
+}
+
+run_check() {
+  local failed=0
+  echo "=== Phoenix drill prerequisites ==="
+  check_paths "Fleet architecture" "$ROOT/docs/workstation-independence-fleet-architecture.md" || failed=1
+  check_paths "Coulombcore drain plan" "$ROOT/docs/coulombcore-drain-placement-plan.md" || failed=1
+  check_paths "Phoenix runbook" "$ROOT/docs/phoenix-machine-drill-runbook.md" || failed=1
+  check_paths "railiance-cluster Makefile" "$HOME/railiance-cluster/Makefile" || failed=1
+  check_paths "railiance-platform openbao" "$HOME/railiance-platform/Makefile" || failed=1
+  check_paths "Staged promotion ADR" "$ROOT/../railiance-enablement/docs/staged-promotion.md" 2>/dev/null || \
+    check_paths "RAIL-BS-WP-0006 reference" "$ROOT/workplans/archived" || failed=1
+  if [[ "$failed" -eq 0 ]]; then
+    echo "RESULT: prerequisites satisfied (dry-run only)"
+  else
+    echo "RESULT: gaps found — see runbook"
+    exit 1
+  fi
+}
+
+run_plan() {
+  cat <<'PLAN'
+=== Phoenix machine drill plan (non-destructive) ===
+
+1. Custody gate — operator approves target machine and OpenBao/unseal paths.
+2. railiance-cluster — ansible/bootstrap.yml against disposable inventory.
+3. railiance-platform — openbao-init-unseal proof chain (NET-WP-0020).
+4. Staged promotion — deploy workload overlay via RAIL-BS-WP-0006 contract.
+5. CNPG restore drill — forgejo-restore-drill or workload-specific restore.
+6. Core Hub / State Hub smoke — deployed-smoke + readiness-summary.
+7. Fleet mesh — register atm- tunnels on new node; retire workstation relay.
+8. Evidence — record run ids, counts, rollback commands; no secrets in Git.
+
+Live wipe/rebuild proof requires operator-selected disposable target (haskelseed/VM).
+See docs/phoenix-machine-drill-runbook.md.
+PLAN
+}
+
+case "$MODE" in
+  check) run_check ;;
+  plan) run_plan ;;
+  -h|--help) usage ;;
+  *) echo "Unknown mode: $MODE" >&2; usage >&2; exit 2 ;;
+esac