BINKY-WP-0004 T04/T05 done, T06 blocked with cutover runbook

- T04: executor-worker MVP (new repo ~/executor-worker) ran one task
  end-to-end: kaizen schedule-prepare persona, agentic llm-connect
  session, sandbox commit e043f21, hub progress event
- T05: recurring mailbox scan fully wired (two-phase: deterministic
  credentialed scan + LLM triage session with suspicious-mail log-only
  rule); email checklist item 9 now gated only on Lane 3 AppRole
- T06: blocked — gates are DEC-2026-002, Red-lane Lanes 2/3, Railiance
  deploy, 3 verified runs; runbook at
  integrations/executor-cutover-runbook.md

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

integrations/company-email-openbao.md

@@ -97,10 +97,15 @@ Scan output under `mailmeta/` — metadata only (no message bodies in git).
        `mailmeta/reports/` (scan c3c7e784…). Notable: Stripe webhook
        failure notice, Qonto Beleg reminders, HUB31 correspondence,
        2 suspicious external mails (ignored, never acted on)
-9. [ ] Recurring scan via activity-core (BINKY-WP-0004 T03/T05; auth
-       blocker solved on paper — non-interactive AppRole lane designed in
-       `integrations/executor-worker-secrets.md`, provisioning is founder
-       Red lane)
+9. [~] Recurring scan via activity-core (BINKY-WP-0004 T05): fully wired —
+       `executor-worker mail-scan` (deterministic scan phase: AppRole or
+       ambient bao token → email-connect read-only → hub
+       `binky_mail_intake` event on success only) + triage session spec
+       (`~/executor-worker/examples/task-binky-mail-triage.json`, includes
+       the suspicious-mail log-only rule). Goes live once the founder
+       provisions the Lane 3 AppRole
+       (`integrations/executor-worker-secrets.md`) and T06 enables
+       `binky-weekly-mail-intake`.
 
 ### Founder provision (step 6) — interactive human shell