finish(CUST-WP-0054): workstation independence engineering closeout

Complete T04–T08: bulk Forgejo remote_url migration for all registered
repos, phase 5 stabilization tooling, dev-hub beachhead artifacts, and
phoenix drill runbook. Archive workplan with T09/T10 as operator gates.

tools/phoenix-drill.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Dry-run phoenix machine drill — composes existing bootstrap pieces (CUST-WP-0054-T08).
+set -euo pipefail
+
+MODE="${1:-check}"
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+usage() {
+  cat <<'USAGE'
+Usage: phoenix-drill.sh [check|plan]
+
+  check — verify required repos, Make targets, and runbooks exist
+  plan  — print ordered drill steps without executing destructive actions
+USAGE
+}
+
+step_ok() { printf '  [ok] %s\n' "$*"; }
+step_miss() { printf '  [missing] %s\n' "$*"; }
+
+check_paths() {
+  local label="$1"
+  local path="$2"
+  if [[ -e "$path" ]]; then
+    step_ok "$label → $path"
+    return 0
+  fi
+  step_miss "$label → $path"
+  return 1
+}
+
+run_check() {
+  local failed=0
+  echo "=== Phoenix drill prerequisites ==="
+  check_paths "Fleet architecture" "$ROOT/docs/workstation-independence-fleet-architecture.md" || failed=1
+  check_paths "Coulombcore drain plan" "$ROOT/docs/coulombcore-drain-placement-plan.md" || failed=1
+  check_paths "Phoenix runbook" "$ROOT/docs/phoenix-machine-drill-runbook.md" || failed=1
+  check_paths "railiance-cluster Makefile" "$HOME/railiance-cluster/Makefile" || failed=1
+  check_paths "railiance-platform openbao" "$HOME/railiance-platform/Makefile" || failed=1
+  check_paths "Staged promotion ADR" "$ROOT/../railiance-enablement/docs/staged-promotion.md" 2>/dev/null || \
+    check_paths "RAIL-BS-WP-0006 reference" "$ROOT/workplans/archived" || failed=1
+  if [[ "$failed" -eq 0 ]]; then
+    echo "RESULT: prerequisites satisfied (dry-run only)"
+  else
+    echo "RESULT: gaps found — see runbook"
+    exit 1
+  fi
+}
+
+run_plan() {
+  cat <<'PLAN'
+=== Phoenix machine drill plan (non-destructive) ===
+
+1. Custody gate — operator approves target machine and OpenBao/unseal paths.
+2. railiance-cluster — ansible/bootstrap.yml against disposable inventory.
+3. railiance-platform — openbao-init-unseal proof chain (NET-WP-0020).
+4. Staged promotion — deploy workload overlay via RAIL-BS-WP-0006 contract.
+5. CNPG restore drill — forgejo-restore-drill or workload-specific restore.
+6. Core Hub / State Hub smoke — deployed-smoke + readiness-summary.
+7. Fleet mesh — register atm- tunnels on new node; retire workstation relay.
+8. Evidence — record run ids, counts, rollback commands; no secrets in Git.
+
+Live wipe/rebuild proof requires operator-selected disposable target (haskelseed/VM).
+See docs/phoenix-machine-drill-runbook.md.
+PLAN
+}
+
+case "$MODE" in
+  check) run_check ;;
+  plan) run_plan ;;
+  -h|--help) usage ;;
+  *) echo "Unknown mode: $MODE" >&2; usage >&2; exit 2 ;;
+esac