fix(workplans): adopt ADR-007 derived identifiers for unregistered records

These workplans exist only in the retired local hub. Their random pre-ADR-007
identifiers are refused by C-06 as stale references, so they cannot be
registered. Deriving from the canonical record id takes no identity from
anything: central does not hold them and the old ids die with the cache.

Records central already holds were deliberately left untouched.

Refs CUST-WP-0068-T06

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

workplans/KEY-WP-0005-iam-profile-core-claims.md

@@ -9,7 +9,7 @@ owner: codex
 topic_slug: netkingdom
 created: "2026-07-23"
 updated: "2026-07-23"
-state_hub_workstream_id: "74ac0d31-b86e-449d-89b2-4e15263bf050"
+state_hub_workstream_id: "711a8303-69aa-5db6-9043-92530c6dc81b"
 ---
 
 # IAM Profile core claims: tenant, principal_type, groups, roles, assurance, tenant_roles
@@ -47,7 +47,7 @@ correct `tenant:friendly:binky` token at all).
 id: KEY-WP-0005-T01
 status: done
 priority: high
-state_hub_task_id: "66107caf-ba26-4291-bb09-1f9e58275505"
+state_hub_task_id: "32d5fbdc-cd2b-5bc8-9d2b-1a410b55e806"
 ```
 
 Bring `token.go`'s claim assembly up to `iam-profile_v0.3.md`'s Core Claims
@@ -141,7 +141,7 @@ human included.
 id: KEY-WP-0005-T02
 status: done
 priority: high
-state_hub_task_id: "1b8f44b4-2763-4d5a-a3eb-1c2b9a25dd15"
+state_hub_task_id: "c3ee6021-b28d-50a5-be60-ecb5631f56e9"
 ```
 
 At token-issuance time, call `tenant-engine`'s cache-read endpoint
@@ -204,7 +204,7 @@ whatever id shape the test author happened to pick and never caught this.
 id: KEY-WP-0005-T03
 status: done
 priority: low
-state_hub_task_id: "34555bf7-0f18-4dac-ade2-6ff3738f353f"
+state_hub_task_id: "c88a3457-2964-5c44-8220-76f82df3a753"
 ```
 
 Confirm T01–T02 done; conformance suite green for both tasks together.