Implement ACTIVITY-WP-0024 operator automation console

Add /ops REST inventory, status, runs, and fail-closed operator-token
mutations (trigger, enable/disable, pause/unpause) with audit trail.
Ship thin HTML UI at /ops/ui, runbook/k8s access docs, and contract tests.

SCOPE.md

@@ -84,9 +84,12 @@ The two evaluation modes:
   (load → resolve → evaluate → report → **log_run** → emit). Emit failures no
   longer skip `activity_runs` rows.
 - **REST admin API** (FastAPI): CRUD, manual trigger, admin sync, metrics.
+- **Operator automation console** (ACTIVITY-WP-0024): `/ops` inventory, status
+  window, run history, Run now / enable / disable / pause with operator-token
+  auth (fail-closed), plus thin HTML UI at `/ops/ui`.
 - **Automation status surface**: `make automation-status` and
   `make prod-automation-status` / `scripts/prod_automation_status.sh` for
-  railiance01 evidence without LLM authority.
+  railiance01 evidence without LLM authority (same contract as `/ops/automations/status`).
 - **Operational runbook**: `docs/runbook.md`, emission boundary docs.
 
 ---
@@ -103,7 +106,9 @@ The two evaluation modes:
 - **General ops control plane** — Kubernetes, SSH, tunnels, secret custody,
   OpenBao policy administration.
 - **Event broker / Temporal server hosting** — consume, do not own lifecycle.
-- **End-user task UI**.
+- **End-user task UI** — tracking human work items. The **operator automation
+  console** (`/ops`) is in scope; it manages ActivityDefinitions and schedules,
+  not task lifecycle.
 - **Coding assistant schedulers** as production authority.
 
 **Boundary note (side-effect resolvers):** A small set of shell/context
@@ -208,7 +213,7 @@ Open product/policy workplan: **ACTIVITY-WP-0022** (IssueSink no-default-Forgejo
 | **G7. Credential delivery** | Low (residual) | **FORGEJO_TOKEN** via ESO `actcore-forgejo-admin` (WP-0023-T05, Ready). issue-core `GITEA_BACKEND_TOKEN` still 503 forgejo-inbox for path A rest — **issue-core owner** (WP-0023-T06). |
 | **G8. Live-images hygiene** | Medium (ops) | Multi-cluster `live-images-all.txt` must be refreshed after deploys or prune can delete live tags (incident 2026-07-21, restored). `scripts/refresh_live_images.sh` (T04). |
 | **G9. Evidence federation** | Low | Progress often lands on railiance01 edge/hub; workstation primary hub may not show the same feed without tunnel/outbox health. |
-| **G10. API external access** | Low | ClusterIP-only; intentional until auth policy. |
+| **G10. API external access** | Low | ClusterIP-only; ops mutations use operator token (WP-0024). Public Ingress / OIDC still deferred. |
 
 ### Drift risks