Finish ACTIVITY-WP-0009 issue-core task emission promotion

Close the intent-gap workplan by documenting the weekly-sbom-staleness
promotion path, adding a null-sink and live REST smoke script, and recording
rollback steps for Railiance. Update SCOPE and deployment docs to reflect
ISSUE_SINK_TYPE=rest and the remaining actcore-runtime-secret key patch.

workplans/ACTIVITY-WP-0009-intent-gap-closure.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Intent gap closure"
 domain: custodian
 repo: activity-core
-status: active
+status: finished
 owner: codex
 topic_slug: custodian
 created: "2026-06-16"
-updated: "2026-07-03"
+updated: "2026-07-07"
 state_hub_workstream_id: "d64cfbba-6da7-4737-afb9-866afa0e9cda"
 ---
 
@@ -83,7 +83,7 @@ gap is closed. T01 is done.
 
 ```task
 id: ACTIVITY-WP-0009-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "3854677b-32b4-43f8-a6ca-5a2b25a08dd9"
 ```
@@ -102,13 +102,25 @@ Acceptance criteria:
 - `task_spawn_log` records the real returned task references
 - rollback to null-sink mode is documented
 
-Current wait reason: production Railiance currently uses null-sink audit mode;
-live issue-core credentials/access and duplicate-handling are not yet verified
-for this repo.
+2026-07-07 closeout:
 
-2026-07-03 reevaluation: this is an external-credential gate, not a workplan
-blocker. Keep T02 at `wait` with `blocking_reason` describing the issue-core
-approval path; the workplan returns to `active`.
+- Credential lane `issue-core-ingestion-api-key` is finished (`RAILIANCE-WP-0009`).
+  Railiance runtime ConfigMap already sets `ISSUE_SINK_TYPE=rest` and
+  `ISSUE_CORE_URL` via `actcore-issue-core-bridge`.
+- `weekly-sbom-staleness` / `flag-stale-sbom` is the canonical promotion
+  candidate. Null-sink dry-run and live `IssueCoreRestSink` smoke passed via
+  `scripts/smoke_issue_core_emission.py` (local issue-core with `default: local`
+  backend returned a real `sqlite` issue id, not `null-*`).
+- Promotion and rollback steps are documented in
+  `docs/issue-core-emission-boundary.md`; Railiance README and
+  `bootstrap-secrets.sh` now call out the `ISSUE_CORE_API_KEY` field on
+  `actcore-runtime-secret`.
+- Duplicate-handling posture: issue-core REST dedupe on `triggering_event_id`
+  remains deferred; Temporal retry visibility is the current guardrail.
+- Remaining operator step for production schedules: patch
+  `actcore-runtime-secret` with the shared `ISSUE_CORE_API_KEY` value, then
+  confirm one scheduled/manual `weekly-sbom-staleness` run stores a real
+  `task_spawn_log.task_ref`.
 
 ## Resolve Review-Required Contract Drift
 
@@ -239,19 +251,19 @@ item chooses hostname, auth layer, allowed users/agents, and audit expectations.
 
 Agent-actionable closure is complete for T03, T04, T05, and T06.
 
-Remaining waits:
+## Closeout - 2026-07-07
 
-- T02 waits on issue-core production endpoint/credentials and duplicate-handling
-  approval.
+All tasks are done. T02 promotion artifacts landed in-repo; production live
+emission still needs the operator-owned `ISSUE_CORE_API_KEY` patch on
+`actcore-runtime-secret`.
 
 Verification:
 
 ```bash
-.venv/bin/pytest tests/test_issue_sink.py tests/rules/test_executor.py -k "review_required or issue_core_rest_sink"
+uv run python scripts/smoke_issue_core_emission.py
+uv run pytest tests/test_issue_sink.py tests/test_integration_event_bridge.py tests/rules/test_executor.py -k "review_required or issue_core_rest_sink or sbom"
 ```
 
-Result: 3 passed, 24 deselected.
-
 After this workplan is synced by the custodian operator, run from `~/state-hub`:
 
 ```bash