fix(workplans): qualify ad-hoc identifiers with the repository prefix

`ADHOC-YYYY-MM-DD` is unique per date but not per repository, so any two repos
opening an ad-hoc on the same day collide. The 2026-08-26 fleet projection
reset refused 9 records for exactly this reason.

Canon (work-record-types_v0.1, CUST-WP-0066) settled the form as
`{PREFIX}-WP-ADHOC-YYYY-MM-DD`, filename unchanged, and grandfathered existing
ids on the condition they are never *silently* re-derived. This is the explicit
migration that clause allows for.

The hub id is derived from the record id, so a changed id is a different
record: stale state_hub_*_id fields are dropped and fix-consistency re-derives.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

workplans/ADHOC-2026-08-17.md

@@ -1,5 +1,5 @@
 ---
-id: ADHOC-2026-08-17
+id: WARDEN-WP-ADHOC-2026-08-17
 type: workplan
 title: "Ad Hoc Tasks — 2026-08-17"
 domain: infotech
@@ -9,7 +9,6 @@ owner: claude
 topic_slug: custodian
 created: "2026-08-17"
 updated: "2026-08-17"
-state_hub_workstream_id: "8376eb89-36f2-52b0-a59a-2954b2e49349"
 ---
 
 # Ad Hoc Tasks — 2026-08-17
@@ -21,10 +20,9 @@ workload-identity owner.
 ### T01 — Answer flex-auth: how should `/v1/check` authenticate its callers?
 
 ```task
-id: ADHOC-2026-08-17-T01
+id: WARDEN-WP-ADHOC-2026-08-17-T01
 status: done
 priority: high
-state_hub_task_id: "b980d1f7-2fcc-58dd-97d8-6e9b9ba57bc9"
 ```
 
 flex-auth (msg `130a148c`, FLEX-WP-0015 T02) reported that `POST /v1/check` and
@@ -69,10 +67,9 @@ Their four questions answered in `wiki/NetKingdomSecurityMap.md`
 ### T02 — user-engine: USER_ENGINE_PROXY_SECRET stays railiance-apps; record consumer-only
 
 ```task
-id: ADHOC-2026-08-17-T02
+id: WARDEN-WP-ADHOC-2026-08-17-T02
 status: done
 priority: medium
-state_hub_task_id: "e76b9b3e-189b-5a4f-8815-4ccf2057507c"
 ```
 
 user-engine (msg `2af4a124`) answered the open confirm question on
@@ -95,10 +92,9 @@ consumes it and has no authority over custody, rotation, or issuance.
 ### T03 — key-cape: `rapp-qonto-keycape-client` interim accepted; refresh the blocker
 
 ```task
-id: ADHOC-2026-08-17-T03
+id: WARDEN-WP-ADHOC-2026-08-17-T03
 status: done
 priority: medium
-state_hub_task_id: "edfb0626-5022-5f49-aaf9-08e0d1002b90"
 ```
 
 key-cape (msg `099b7cba`) acknowledged the lane staying interim on ops-warden.
@@ -118,10 +114,9 @@ workplan.
 ### T04 — Session hygiene
 
 ```task
-id: ADHOC-2026-08-17-T04
+id: WARDEN-WP-ADHOC-2026-08-17-T04
 status: done
 priority: low
-state_hub_task_id: "62109af6-f095-5e7b-9258-0fcec29d30e8"
 ```
 
 - [x] `uv run pytest -q` → 338 passed, 4 deselected (routing anchor + no-double-source