fix(workplans): adopt ADR-007 derived identifiers for unregistered records

These workplans exist only in the retired local hub. Their random pre-ADR-007
identifiers are refused by C-06 as stale references, so they cannot be
registered. Deriving from the canonical record id takes no identity from
anything: central does not hold them and the old ids die with the cache.

Records central already holds were deliberately left untouched.

Refs CUST-WP-0068-T06

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

workplans/NK-WP-0025-public-self-registration-and-application-jit.md

@@ -14,7 +14,7 @@ depends_on:
   - USER-WP-0022
   - KEY-WP-0008
   - CSOC-WP-0003
-state_hub_workstream_id: "1638183b-e2cb-4da2-92b8-d39592d62e86"
+state_hub_workstream_id: "2412a251-d6b5-5f05-8082-3eb7697c51dc"
 ---
 
 # NK-WP-0025 - public registration and application JIT provisioning
@@ -58,7 +58,7 @@ unverified email-only local account.
 id: NK-WP-0025-T01
 status: done
 priority: high
-state_hub_task_id: "523d5894-6ab6-4097-a28c-0f77880744b1"
+state_hub_task_id: "f6fba00e-1fb6-59be-9b9a-242aed991892"
 ```
 
 Record the source-of-truth split, stable key `(issuer, subject)`, optional
@@ -79,7 +79,7 @@ attributes and are not account-link keys.
 id: NK-WP-0025-T02
 status: done
 priority: high
-state_hub_task_id: "bc220e2b-4cd1-4dcf-b107-12ef3595fe14"
+state_hub_task_id: "b0d7ac51-54ae-508b-b62d-8ac8dff34497"
 ```
 
 Expose a NetKingdom registration service behind user-engine. Validate and
@@ -120,7 +120,7 @@ provider failure after local completion, and run disposable live conformance.
 id: NK-WP-0025-T03
 status: done
 priority: high
-state_hub_task_id: "3ec4a9a0-cbce-4c63-8ed8-db36f4cae0fb"
+state_hub_task_id: "ed93741b-8bb7-5b37-b5c5-a06e7f826735"
 ```
 
 Publish a NetKingdom registration URL and allow applications to provide
@@ -148,7 +148,7 @@ request. The fresh OIDC flow remains provider-owned after password setup.
 id: NK-WP-0025-T04
 status: done
 priority: high
-state_hub_task_id: "cf2e4d05-fd07-4bc3-92ff-b2a5ade97846"
+state_hub_task_id: "2b9a60cc-44a2-5874-8e7e-21db96da88f0"
 ```
 
 Replace global mandatory MFA for this consumer with the KeyCape policy from
@@ -176,7 +176,7 @@ Client and tenant allow-list negatives also fail before mail issuance.
 id: NK-WP-0025-T05
 status: done
 priority: high
-state_hub_task_id: "5d13f9f6-16b1-44c9-8e1d-4630cfe60a7b"
+state_hub_task_id: "68bf6fe7-7b68-5189-ad1c-4ba5e0d0ad6e"
 ```
 
 Test an existing LLDAP identity with no coulomb.social profile, a completely