BINKY-WP-0006: close with three clean railiance mail cycles

Host LLM_CONNECT_URL discovery uses ClusterIP when DNS is unreachable;
mail path fails hard if triage fails. Mark T06 done and workplan finished;
update residual docs (OperatingRhythm, cutover runbook, llm-rhythm).

scripts/railiance-rhythm/run-common.sh

@@ -30,14 +30,31 @@ require_repo() {
 
 require_llm_connect() {
   # Server-side rhythm uses llm-connect HTTP (OpenRouter), never Claude CLI.
+  # Host cannot resolve in-cluster DNS; try reachable bases in order:
+  # 1) explicit LLM_CONNECT_URL  2) local port-forward  3) Service ClusterIP
+  # 4) cluster DNS (works only in-pod).
   if [[ -z "${LLM_CONNECT_URL:-}" ]]; then
-    # Host cannot resolve cluster DNS; default to local port-forward target.
-    # In-cluster Jobs should set LLM_CONNECT_URL to the cluster service.
-    if curl -sf -m 1 "http://127.0.0.1:18080/health" >/dev/null 2>&1 \
-      || curl -sf -m 1 "http://127.0.0.1:18080/" >/dev/null 2>&1; then
-      export LLM_CONNECT_URL="http://127.0.0.1:18080"
-    else
-      export LLM_CONNECT_URL="http://llm-connect.activity-core.svc.cluster.local:8080"
+    local candidates=()
+    candidates+=("http://127.0.0.1:18080")
+    if command -v kubectl >/dev/null 2>&1; then
+      local cip
+      cip="$(kubectl -n activity-core get svc llm-connect \
+        -o jsonpath='{.spec.clusterIP}' 2>/dev/null || true)"
+      if [[ -n "${cip}" ]]; then
+        candidates+=("http://${cip}:8080")
+      fi
+    fi
+    candidates+=("http://llm-connect.activity-core.svc.cluster.local:8080")
+    local u
+    for u in "${candidates[@]}"; do
+      if curl -sf -m 2 "${u}/health" >/dev/null 2>&1; then
+        export LLM_CONNECT_URL="${u}"
+        break
+      fi
+    done
+    if [[ -z "${LLM_CONNECT_URL:-}" ]]; then
+      export LLM_CONNECT_URL="${candidates[-1]}"
+      log "WARN: no llm-connect health probe succeeded; using ${LLM_CONNECT_URL}"
     fi
   fi
   log "LLM_CONNECT_URL=${LLM_CONNECT_URL}"

scripts/railiance-rhythm/run-mail.sh

@@ -17,14 +17,14 @@ log "mail-scan rc=${scan_rc}"
 if [[ "${scan_rc}" -ne 0 ]]; then
   exit "${scan_rc}"
 fi
-# Triage must use llm-connect (OpenRouter), not a host coding agent.
-# Until agent-harness mail-triage exists (BINKY-WP-0006), scan-only is OK.
-if agent-harness mail-triage --help >/dev/null 2>&1; then
-  log "START mail-triage (llm-connect)"
-  agent-harness mail-triage \
-    --target-repo "${BINKY_REPO}" \
-    2>&1 | tee -a "${LOG_DIR}/mail.log" || log "WARN: mail-triage failed"
-else
-  log "SKIP mail-triage: command not available yet (BINKY-WP-0006); scan-only"
+# Triage uses llm-connect (OpenRouter), never a host coding agent.
+log "START mail-triage (llm-connect)"
+agent-harness mail-triage \
+  --target-repo "${BINKY_REPO}" \
+  2>&1 | tee -a "${LOG_DIR}/mail.log"
+triage_rc=${PIPESTATUS[0]}
+log "mail-triage rc=${triage_rc}"
+if [[ "${triage_rc}" -ne 0 ]]; then
+  exit "${triage_rc}"
 fi
 log "END mail-intake"