Close the KEY-WP-0009 handoff gap and deliver the two blocked admissions

KEY-WP-0009-T04 is done. Re-ran verification on main with an explicit Go 1.23.0
toolchain and a writable build cache: contract validator PASS, build, vet and the
full test suite pass, git diff --check clean. gofmt had drifted on
internal/server/telemetry/events.go and tests/migration/scenario_c_test.go
(comment alignment only, no semantic change); both reformatted so the task's
formatting claim holds. The four handoffs to netkingdom, secrets-engine,
ops-warden and railiance-platform were then actually sent -- the 2026-09-05 audit
had shown the earlier claimed delivery had no receipts -- and each receipt id is
recorded in the workplan and readable back from the hub.

KEY-WP-0013-T02 and KEY-WP-0014-T04 stay in wait. Their remaining work is not
ours to do, so what was owed was the request, and it is now delivered: custody
admission for the two approval clients to railiance-platform, the exact human
client id and callback URI to approval-engine, and the OpenBao-token vs
issuer-JWT split plus Qonto rotation execution authority to ops-warden. Each
message quotes the existing non-secret packet or reviewed sequence and states
what is explicitly not being treated as authorization.

No secret was read, no production resource changed, no route retired.
SCOPE.md updated to match.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016uV8zoCKpA1WRAxsKRYbdH

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1182213@bnt-lap001
Assistant-Session: 966597b9-ae61-46a4-8b9e-1594ab3ec4ad

SCOPE.md

@@ -103,8 +103,14 @@ Keycloak interchangeability are not established.
   (KEY-WP-0026). Production
   deployment and custody are external; a source implementation or example client
   fragment does not prove live registration or consumer cutover.
-- Approval-client provisioning, coordinated Qonto rotation, native consumer
-  handoffs and notification receipt closure remain open in KEY-WP-0009/0013/0014.
+- Notification receipt closure is done: KEY-WP-0009 is finished, its four handoffs
+  delivered with receipts readable via `GET /messages/?from_agent=key-cape`.
+  Approval-client provisioning (KEY-WP-0013-T02) and coordinated Qonto rotation
+  plus the login-proxy consumer split (KEY-WP-0014-T04) remain open. Both requests
+  are now delivered and both wait on owners outside this repository —
+  railiance-platform for custody admission, approval-engine for the exact human
+  callback, ops-warden for the route contract and a rotation execution/rollback
+  authority. No client is materialized in the deployed image and no route changed.
 
 ## Deliberate exclusions