Finish CSOC-WP-0003 and CSOC-WP-0004; residual intakes for Case B

Close self-registration workplan with Case A proven and Create account
entry implemented; park public registration enablement and identity
negatives as CSOC-IN-0001/0002. Complete app-shell workplan with T06
operator runbook (seed, bind, webhook, smoke) and smoke doc updates.

docs/intakes/csoc-residuals.md

@@ -0,0 +1,73 @@
+# coulomb-social residual intakes
+
+File-backed intakes for leftovers from finished workplans. Canon: work-record
+types § Residuals (`origin: residual`, `origin_ref: <WP-id>`).
+
+---
+
+## CSOC-IN-0001 — Enable public Create account + Case B smoke
+
+```yaml
+id: CSOC-IN-0001
+kind: intake
+title: "Enable Create account and Case B registration smoke on app.coulomb.social"
+lane: blue
+status: open
+priority: medium
+owner: coulomb-social
+repo: coulomb-social
+origin: residual
+origin_ref: CSOC-WP-0003
+description: |
+  App entry for Create account is implemented (NETKINGDOM_REGISTRATION_URL,
+  /auth/register/, landing button). Public enablement waits on NetKingdom
+  mailbox verification and published registration URL (NK-WP-0025 / USER-WP-0022).
+
+  When the platform registration URL is live:
+
+  1. Set NETKINGDOM_REGISTRATION_URL on coulomb-social-env (names only in git;
+     example shape in .env.example).
+  2. Confirm landing shows Create account and /auth/register/ redirects only to
+     that URL (no open redirect via ?next=).
+  3. Run Case B: brand-new public registration → verified mail → OIDC → first
+     Member JIT on app.coulomb.social.
+  4. Record evidence under docs/identity/smoke.md.
+
+  DoC-Ok: residual of finished CSOC-WP-0003; platform dependency explicit.
+notes: |
+  Depends on NK-WP-0025 (registration orchestration + mail path).
+  Related: CSOC-IN-0002 (identity negatives after Case B).
+state_hub_intake_id: "019ff532-3694-7868-a3a7-f4b4f28a647a"
+```
+
+---
+
+## CSOC-IN-0002 — Identity negative matrix after Case B
+
+```yaml
+id: CSOC-IN-0002
+kind: intake
+title: "Record identity negatives: state replay, collision, step-up"
+lane: green
+status: open
+priority: low
+owner: coulomb-social
+repo: coulomb-social
+origin: residual
+origin_ref: CSOC-WP-0003
+description: |
+  CSOC-WP-0003 Case A (known LLDAP login) is proven. Remaining negatives listed
+  in docs/identity/smoke.md should be executed when Case B unblocks (or sooner
+  offline/dev if useful):
+
+  - OIDC state/nonce replay
+  - issuer+subject collision (single Member)
+  - email-only must not take over another subject
+  - step-up ACR rejection when assurance insufficient
+  - registration redirect allow-list only
+
+  Capture pass/fail in docs/identity/smoke.md; close this intake when recorded.
+notes: |
+  Pulls from CSOC-IN-0001 for live registration path; some checks can run offline.
+state_hub_intake_id: "019ff532-3ade-7d75-acb7-2bbfa264fcb8"
+```