fix(workplans): adopt ADR-007 derived identifiers for unregistered records

These workplans exist only in the retired local hub. Their random pre-ADR-007
identifiers are refused by C-06 as stale references, so they cannot be
registered. Deriving from the canonical record id takes no identity from
anything: central does not hold them and the old ids die with the cache.

Records central already holds were deliberately left untouched.

Refs CUST-WP-0068-T06

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md

@@ -16,7 +16,7 @@ related_workplans:
   - WARDEN-WP-0009
 created: "2026-08-19"
 updated: "2026-08-19"
-state_hub_workstream_id: "5c0fac68-284d-4672-9824-8686a902d33f"
+state_hub_workstream_id: "f29f159c-c79e-5c78-b1e8-569a5b63d231"
 ---
 
 # FLEX-WP-0016 - In-cluster ops-warden policy pin so policy.enabled can flip
@@ -60,7 +60,7 @@ flip wait on that calling side.
 id: FLEX-WP-0016-T01
 status: done
 priority: high
-state_hub_task_id: "3d7fde8e-00b1-4bc3-be28-00afd37997ac"
+state_hub_task_id: "b2f8052e-3686-593f-9359-dfd08d530a26"
 ```
 
 **Overlay pin.** Add `values/ops-warden.yaml`: same digest as the A2 pins,
@@ -77,7 +77,7 @@ warn, isolated, production registry. `tests/stage1.sh` renders it.
 id: FLEX-WP-0016-T02
 status: done
 priority: high
-state_hub_task_id: "9f30410f-e2b3-4b0a-9d70-6f6a12d2822e"
+state_hub_task_id: "aa65f534-7401-5231-ae82-ea6e3d09b40c"
 ```
 
 **Deploy warn.** `helm upgrade --install flex-auth-ops-warden` from the
@@ -97,7 +97,7 @@ user-engine and tenant-engine pins were not moved.
 id: FLEX-WP-0016-T03
 status: done
 priority: medium
-state_hub_task_id: "65df7141-58f0-4be8-bc62-07f29cb96856"
+state_hub_task_id: "351f502f-f0cf-5a70-86da-10b1fbe39dae"
 ```
 
 **Handoff for the flip.** Tell ops-warden the Service DNS, digest, warn mode,