feat(backup): apps-pg restore drill + close WP-0014

Add tools/apps-pg-restore-drill.sh and make target; T04 evidence for
vergabe_db row-count gate. Archive finished RAILIANCE-WP-0014.

workplans/archived/260712-RAILIANCE-WP-0014-core-hub-helm-cutover-vergabe-refresh.md

@@ -0,0 +1,105 @@
+---
+id: RAILIANCE-WP-0014
+type: workplan
+title: "Core Hub Helm cutover and vergabe-teilnahme image refresh"
+domain: financials
+repo: railiance-apps
+status: finished
+owner: codex
+topic_slug: railiance
+created: "2026-07-10"
+updated: "2026-07-11"
+state_hub_workstream_id: "780c8d1d-ea75-479e-9733-10b518dde242"
+---
+
+# Core Hub Helm cutover and vergabe-teilnahme image refresh
+
+Follow-up to `RAILIANCE-WP-0012` and custodian inbox `3ced85c7`. The S5 Helm
+chart, values, Makefile targets, and runbook exist; the live cluster may still
+run Core Hub from `core-hub/k8s/railiance-production/` manifests.
+
+Separately, the 2026-07-10 delivery-lane snapshot shows `vergabe-teilnahme`
+deployed at `f95de14` while the source repo head is `1061f3e` (14-commit drift).
+
+Production-touching deploy steps require explicit image tags and operator
+approval. Do not store secrets in workplans.
+
+## Core Hub server dry-run on CoulombCore
+
+```task
+id: RAILIANCE-WP-0014-T01
+status: done
+priority: high
+state_hub_task_id: "b9dea9f3-f0c0-41c1-b9c4-ec4c44d43d55"
+```
+
+CoulombCore production cluster confirmed. `core-hub-server-dry-run` passed after
+`make core-hub-helm-adopt` and configMap name alignment (`core-hub-prod-runtime`).
+Live image `gitea.coulomb.social/coulomb/core-hub:a33191a` verified.
+
+## Adopt Helm-managed Core Hub release
+
+```task
+id: RAILIANCE-WP-0014-T02
+status: done
+priority: high
+state_hub_task_id: "0e591104-0123-4e4a-84ff-5deb435e8441"
+```
+
+`CORE_HUB_IMAGE_TAG=a33191a make core-hub-deploy` installed Helm release
+`core-hub` revision 1 on CoulombCore. Resources carry Helm ownership metadata.
+Service-repo `k8s/railiance-production/` path is now superseded for operations.
+
+## Verify Core Hub post-cutover smoke
+
+```task
+id: RAILIANCE-WP-0014-T03
+status: done
+priority: high
+state_hub_task_id: "eca3ce8b-68a8-44d0-90c7-2cdefa482200"
+```
+
+Post-deploy `make core-hub-status` and `make core-hub-smoke` passed on
+`https://hub.coulomb.social` after Helm rollout (2026-07-10).
+
+## Refresh vergabe-teilnahme production image
+
+```task
+id: RAILIANCE-WP-0014-T04
+status: done
+priority: medium
+state_hub_task_id: "d547f68d-52ec-4ff1-952b-ec70c834e0d3"
+```
+
+2026-07-11: Migrated deploy target to **Forgejo OCI** (`forgejo.coulomb.social`).
+Added `.forgejo/workflows/image.yaml` in `vergabe-teilnahme`; Makefile
+`check-vergabe-image` gates deploy. `helm/vergabe-teilnahme-values.yaml` targets
+Forgejo repository + tag `dfbc13a`.
+
+2026-07-12: **CI root cause fixed** — Forgejo Actions run failed because
+`uv sync` resolved `issue-core` from Forgejo PyPI (404). Fix: `uv sync --frozen`
+in `vergabe-teilnahme` Dockerfile (`dfbc13a`); workflow aligned with
+`railiance-enablement` container-build template. Local docker build verified.
+`issue-core` gained `publish-forgejo` + `.forgejo/workflows/publish-python-package.yml`
+so PyPI can move off Gitea (`uv.lock` still pins Gitea wheel URLs until publish).
+
+**Deployed 2026-07-12:** operator `docker login forgejo.coulomb.social`; image
+`forgejo.coulomb.social/coulomb/vergabe-teilnahme:dfbc13a` pushed manually;
+`VERGABE_IMAGE_TAG=dfbc13a make vergabe-deploy` (Helm rev 3). Pod healthy;
+`https://vergabe-teilnahme.whywhynot.de/health/` → 200. Gitea image retired
+for this workload.
+
+## Post-deploy vergabe smoke and runbook evidence
+
+```task
+id: RAILIANCE-WP-0014-T05
+status: done
+priority: medium
+state_hub_task_id: "4eaaa345-4252-46c1-bd8a-49d654ec48f4"
+```
+
+After deploy, run `make vergabe-status`, migrations if required, and HTTPS smoke
+against `vergabe-teilnahme.whywhynot.de`. Update `docs/vergabe-teilnahme.md`
+with the deployed tag, date, and smoke result (non-secret).
+
+Blocked on: `RAILIANCE-WP-0014-T04`.