Add repository grant v2 publish scope and adopt daily security flow

ACTIVITY-WP-0046: grant v2 carries a publish scope (remote, branch, path
prefixes inside allowed_paths, fast-forward only) in its canonical grant id;
v1 stays local-only with unchanged ids.

ACTIVITY-WP-0047: disabled daily-security-flow definition dispatching the
the-custodian runner as an ops_run (CUST-WP-0079-T03).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 296847@bnt-lap001
Assistant-Session: 4f997d46-1b9d-4131-9699-0c353a215155

workplans/ACTIVITY-WP-0046-repository-grant-v2-publish-scope.md

@@ -0,0 +1,62 @@
+---
+id: ACTIVITY-WP-0046
+type: workplan
+title: "Repository grant v2: publish scope for governed pushes (REINAH-WP-0003-T04)"
+domain: infotech
+repo: activity-core
+status: active
+owner: claude-activity-core
+topic_slug: activity-core
+created: "2026-10-13"
+updated: "2026-10-13"
+flavor: implementation
+related: [REINAH-WP-0003, ACTIVITY-WP-0038, ASSEMBLY-WP-0010]
+---
+
+Origin: rein-aharness (message 3eb4fa11, 2026-10-13) needs the repository grant
+that Activity Core carries on each ops_run to scope publication, so that
+assembly-checkpoint can leave legacy substring routing before
+`AGENT_HARNESS_LEGACY_APPROACHES_UNTIL` (2026-12-31). Founder chose option 1a
+on 2026-10-13: Activity Core adds the scope; no temporary tenant-declared grant.
+
+Grant v1 stays local-only and its grant ids do not change. v2 adds
+`publish_scope` (remote, branch, path prefixes inside `allowed_paths`,
+fast-forward only). Activity Core admits and carries the grant; rein-aharness
+enforces it and refuses any push without it.
+
+## Admission and carriage
+
+```task
+id: ACTIVITY-WP-0046-T01
+status: done
+priority: high
+```
+
+Extend `repository_grant.py` with `PublishScope` and version "2"; include the
+scope in the canonical grant id; reject inconsistent v1/v2 combinations and
+prefixes outside `allowed_paths`; accept publish evidence keys in
+`glas_evidence`. Document the contract in `docs/ops-run-queue.md`. Tests in
+`tests/test_repository_grant.py`.
+
+## rein-aharness contract confirmation
+
+```task
+id: ACTIVITY-WP-0046-T02
+status: wait
+priority: high
+```
+
+rein-aharness confirms it computes the same v2 grant id and enforces the scope
+(REINAH-WP-0003-T04). Wait: reply sent 2026-10-13.
+
+## assembly-checkpoint definitions adopt v2
+
+```task
+id: ACTIVITY-WP-0046-T03
+status: wait
+priority: medium
+```
+
+assembly-economics declares a v2 grant on its checkpoint definitions and the
+production image carrying this change is rolled out before 2026-12-15. Wait:
+T02, then an image release through the normal GitOps path.

workplans/ACTIVITY-WP-0047-daily-security-flow-adoption.md

@@ -0,0 +1,62 @@
+---
+id: ACTIVITY-WP-0047
+type: workplan
+title: "Adopt the daily security-flow schedule (CUST-WP-0079-T03)"
+domain: infotech
+repo: activity-core
+status: active
+owner: claude-activity-core
+topic_slug: activity-core
+created: "2026-10-13"
+updated: "2026-10-13"
+flavor: implementation
+related: [CUST-WP-0079]
+---
+
+Origin: the-custodian handed over the daily security-flow lane (message
+117e538e, case `case:cross-owner:CUST-WP-0079-T03:activity-core`). The workstation
+user systemd bus is unavailable, so no host timer can run it. Founder accepted
+adoption on 2026-10-13.
+
+Boundary: Activity Core owns the schedule and the ops_run record. the-custodian
+owns `scripts/security_flow_daily.py`, its report and delivery checkpoints. A
+rein runs the fixed command; Activity Core does not execute it (SCOPE: no
+general execution). The run carries no repository grant.
+
+## Source definition
+
+```task
+id: ACTIVITY-WP-0047-T01
+status: done
+priority: high
+```
+
+`activity-definitions/daily-security-flow.md`: daily 07:30 Europe/Berlin,
+misfire skip, one unconditional rule emitting an ops_run on
+`harness.agent-dev-local@1.1.1` with the fixed command and correlation
+`CUST-WP-0079-T03`. Committed with `enabled: false`.
+
+## Activation
+
+```task
+id: ACTIVITY-WP-0047-T02
+status: wait
+priority: high
+```
+
+Wait: the claiming rein (rein-aharness, workstation profile) confirms it can
+run the command against workstation checkouts with hub access. Then flip
+`enabled: true`, release through the normal image/GitOps path, admin-sync, and
+run one manual trigger.
+
+## First unassisted fire
+
+```task
+id: ACTIVITY-WP-0047-T03
+status: wait
+priority: medium
+```
+
+Observe one scheduled fire end to end (ops_run completed, report written, no
+duplicate deliveries) and tell the-custodian so CUST-WP-0079-T03 can close.
+Wait: T02.