Finish ACTIVITY-WP-0009 issue-core task emission promotion

Close the intent-gap workplan by documenting the weekly-sbom-staleness
promotion path, adding a null-sink and live REST smoke script, and recording
rollback steps for Railiance. Update SCOPE and deployment docs to reflect
ISSUE_SINK_TYPE=rest and the remaining actcore-runtime-secret key patch.

docs/issue-core-emission-boundary.md

@@ -46,16 +46,52 @@ task reference before it can replace `IssueCoreRestSink`.
 ## Safe operating modes
 
 - `ISSUE_SINK_TYPE=null`: dry-run/audit mode. Task specs are rendered and the
-  workflow records synthetic `null-*` references. This is the current Railiance
-  production setting.
+  workflow records synthetic `null-*` references. Use this for contract review
+  and emergency rollback.
 - `ISSUE_SINK_TYPE=rest`: live task creation. Sink failures raise out of
   `emit_tasks`, so Temporal retries and the workflow history make failures
-  visible.
+  visible. Railiance runtime ConfigMap uses this mode once
+  `ISSUE_CORE_API_KEY` is present in `actcore-runtime-secret`.
 
-Weekly SBOM staleness is safe to evaluate in dry-run mode because the rule
-contract is deterministic and tested. Do not enable it against the real REST sink
-until `ISSUE_CORE_API_KEY`, endpoint reachability, and duplicate-handling are
-verified in the target environment.
+Weekly SBOM staleness is the canonical promotion candidate because the rule
+contract is deterministic and tested. Promote it only after a null-sink dry-run
+review and one live `IssueCoreRestSink` smoke against the target endpoint.
+
+## Promotion and rollback
+
+### Promote one definition safely
+
+1. Keep `ISSUE_SINK_TYPE=null` and run or wait for the target definition.
+2. Review rendered task specs in `task_spawn_log` (source id, condition,
+   target repo, synthetic `null-*` reference).
+3. Confirm `ISSUE_CORE_URL` reachability and a populated `ISSUE_CORE_API_KEY`
+   on both activity-core and issue-core (same value). Credential custody:
+   `warden route show issue-core-ingestion-api-key --json`.
+4. Run the repo smoke:
+   ```bash
+   uv run python scripts/smoke_issue_core_emission.py
+   ISSUE_CORE_URL=http://127.0.0.1:8765 ISSUE_CORE_API_KEY=... \
+     uv run python scripts/smoke_issue_core_emission.py --live
+   ```
+5. Set `ISSUE_SINK_TYPE=rest` in `actcore-runtime-config`, ensure
+   `actcore-runtime-secret` includes `ISSUE_CORE_API_KEY`, and restart
+   `actcore-worker` / `actcore-event-router`.
+6. Trigger one known-safe run (weekly SBOM staleness on a stale fixture or
+   manual `/activity-definitions/<id>/trigger`) and confirm `task_spawn_log`
+   stores the real `issue_id` returned by issue-core.
+
+### Roll back to null-sink
+
+1. Set `ISSUE_SINK_TYPE=null` in `actcore-runtime-config`.
+2. `kubectl -n activity-core rollout restart deploy/actcore-worker deploy/actcore-event-router`
+3. Verify the next run records synthetic `null-*` references again.
+4. Leave issue-core tasks already created in place; activity-core does not own
+   downstream task lifecycle. Close or cancel duplicates in issue-core if a
+   promotion experiment created unexpected tasks.
+
+Duplicate handling today: issue-core REST ingest does not yet dedupe on
+`triggering_event_id`; Temporal retry visibility is the current guardrail.
+Treat promotion as one-definition-at-a-time until server-side idempotency ships.
 
 ## Verification
 

docs/runbook.md

@@ -520,7 +520,9 @@ Handle in the next operator session:
   calibration.
 - Non-urgent schedule jitter or timeout adjustments.
 - Moving a task sink from `ISSUE_SINK_TYPE=null` to the real issue-core endpoint
-  after a dry-run contract check has passed.
+  after a dry-run contract check has passed. See
+  `docs/issue-core-emission-boundary.md` for the promotion/rollback steps and
+  `scripts/smoke_issue_core_emission.py` for the weekly SBOM staleness smoke.
 
 ### DB migration drift
 ```bash