fix(workplans): adopt ADR-007 derived identifiers for unregistered records

These workplans exist only in the retired local hub. Their random pre-ADR-007
identifiers are refused by C-06 as stale references, so they cannot be
registered. Deriving from the canonical record id takes no identity from
anything: central does not hold them and the old ids die with the cache.

Records central already holds were deliberately left untouched.

Refs CUST-WP-0068-T06

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

workplans/KEY-WP-0007-user-engine-portal-oidc-client.md

@@ -12,7 +12,7 @@ updated: "2026-07-29"
 depends_on:
   - KEY-WP-0005
   - USER-WP-0020
-state_hub_workstream_id: "92727f0c-09a8-4431-88c4-3cb6fe946d27"
+state_hub_workstream_id: "24db4178-705c-5b09-b7db-ee7a345d71a0"
 ---
 
 # KEY-WP-0007 - User-engine portal OIDC relying-party integration
@@ -27,7 +27,7 @@ not move user-domain or authorization ownership into KeyCape.
 id: KEY-WP-0007-T01
 status: done
 priority: high
-state_hub_task_id: "619a642a-da29-4f32-a48e-54e44627f54e"
+state_hub_task_id: "7d722cae-bf6d-52e0-80f4-cc51e9fb42f0"
 ```
 
 Register `user-engine-portal` for authorization code with mandatory S256 PKCE,
@@ -40,7 +40,7 @@ implicit flow, client secret, or dynamic registration is allowed.
 id: KEY-WP-0007-T02
 status: done
 priority: high
-state_hub_task_id: "cbebb6d2-d263-40cb-a5fc-1d16011ad928"
+state_hub_task_id: "0b222062-4352-5ae6-9e85-95787af08409"
 ```
 
 Update the railiance01 KeyCape configuration without exposing its signing key
@@ -53,7 +53,7 @@ unregistered callback denial and successful token exchange through the portal.
 id: KEY-WP-0007-T03
 status: done
 priority: high
-state_hub_task_id: "43f6cd61-70d0-43d7-93d1-e87286466ff2"
+state_hub_task_id: "859e7322-71dc-58cc-9f44-6f869c2d0b59"
 ```
 
 Prove issuer, audience, tenant, groups, roles and assurance claims are verified