Complete Phase 1: policy kernel, REST service, and local smoke tooling

Implements QONTO-WP-0002 (policy-gated Qonto REST service with audit
logging, rate limiting, and credential handling) and the ADHOC-2026-07-21
follow-up (fixture-backed local smoke mode, repo classification metadata).
Marks QONTO-WP-0001/0002 and the ad-hoc workplan finished, and regenerates
WORK-RECORDS.md and the ADHOC workplan's state_hub_workstream_id via
fix-consistency.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

AGENTS.md

@@ -126,18 +126,28 @@ curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
 `tenants/binky/qonto-api` (`API_KEY`, `API_USER`). Clients use assistant URL +
 workload identity only. Policy v1: **no spend / no volume-cost**.
 
-**Local verification (until QONTO-WP-0002 lands runtime):**
+**Local verification (Phase 1 runtime landed):**
+
+Preferred, when `make` and local venv bootstrapping are available:
 
 ```bash
-# Workplan frontmatter ↔ hub
-statehub fix-consistency
-
-# Docs present
-test -f INTENT.md && test -f specs/ArchitectureBlueprint.md
+make install-dev
+make test
+make lint
+make run
 ```
 
-After Phase 1 skeleton exists, prefer `make test` / `make lint` as defined in
-the Makefile from QONTO-WP-0002-T01.
+Verified fallback on this workstation:
+
+```bash
+# Reuse a sibling fleet venv that already contains FastAPI/httpx/pytest
+PYTHONPATH=src ../state-hub/.venv/bin/python -m pytest
+
+# Syntax-only fallback when ruff/dev deps are unavailable
+python3 -m compileall src tests
+```
+
+Operational details live in `docs/operator-runbook.md`.
 
 ---