RAILIANCE-WP-0012/0013/0014: Core Hub S5 release, CNPG observability, and follow-up workplans

Deliver the inbox-suggestion implementation from WP-0012: Core Hub Helm chart
and Makefile targets, CNPG backup status tooling, and updated backup handoff
docs. Archive the finished WP-0012 workplan and register ready follow-ups
WP-0013 (CNPG backup wiring + restore drill) and WP-0014 (Core Hub Helm
cutover and vergabe-teilnahme image refresh).

workplans/archived/260710-RAILIANCE-WP-0012-inbox-suggestions-core-hub-cnpg-backup.md

@@ -0,0 +1,90 @@
+---
+id: RAILIANCE-WP-0012
+type: workplan
+title: "Inbox suggestions — Core Hub S5 release and CNPG backup observability"
+domain: financials
+repo: railiance-apps
+status: finished
+owner: codex
+topic_slug: railiance
+created: "2026-07-10"
+updated: "2026-07-10"
+state_hub_workstream_id: "25cee4ac-d1e4-441a-bc33-cf8c90ee67a6"
+---
+
+# Inbox suggestions — Core Hub S5 release and CNPG backup observability
+
+Sources:
+
+- State Hub inbox `a1957cce` (HIGH): no CNPG backups on railiance01 production DB
+  clusters; evidence `the-custodian/docs/evidence/vergabe-teilnahme-delivery-lane-20260710.json`.
+- State Hub inbox `3ced85c7`: Core Hub release ownership follow-up from
+  `CUST-WP-0052`; cite `the-custodian/docs/core-hub-helixforge-build-alignment.md`
+  and `core-hub/docs/deployment/staging-profile.md`.
+
+## Core Hub Helm chart and production values
+
+```task
+id: RAILIANCE-WP-0012-T01
+status: done
+priority: high
+state_hub_task_id: "0795f034-eacc-41d5-af8f-e5909f72f79f"
+```
+
+Promote the temporary `core-hub/k8s/railiance-production/` profile into
+`charts/core-hub/` with non-secret production and staging values under `helm/`.
+Secrets remain operator-owned (`core-hub-prod-env`, `core-hub-staging-env`).
+
+## Makefile release targets and smoke gate
+
+```task
+id: RAILIANCE-WP-0012-T02
+status: done
+priority: high
+state_hub_task_id: "f975d9d3-e9b4-45ff-8088-03b2a5a855c6"
+```
+
+Add `core-hub-dry-run`, `core-hub-server-dry-run`, `core-hub-deploy`,
+`core-hub-status`, `core-hub-migrate`, `core-hub-smoke`, and staging
+counterparts. Require explicit `CORE_HUB_IMAGE_TAG=<sha>` for production deploys.
+
+## Operator runbook for Core Hub on railiance01
+
+```task
+id: RAILIANCE-WP-0012-T03
+status: done
+priority: medium
+state_hub_task_id: "41cba5e9-2c19-4b90-9dbe-517a3413eac7"
+```
+
+Document the S5 release path in `docs/core-hub-on-railiance01.md`, including
+migration boundary, ingress cutover notes, rollback, and links to Core Hub
+service-repo smokes.
+
+## CNPG backup posture observability
+
+```task
+id: RAILIANCE-WP-0012-T04
+status: done
+priority: high
+state_hub_task_id: "7c9794ca-478c-4da9-ae77-b3aa62924e98"
+```
+
+Add `make cnpg-backup-status` and `tools/cnpg-backup-status.sh` to report backup
+spec and `ScheduledBackup` coverage for `apps-pg`, `forgejo-db`,
+`net-kingdom-pg`, and `state-hub-db`. Include operator-ready manifest templates
+for barman `ObjectStore` and `ScheduledBackup` wiring once platform supplies
+object-store credentials.
+
+## Update app data backup handoff with delivery-lane evidence
+
+```task
+id: RAILIANCE-WP-0012-T05
+status: done
+priority: medium
+state_hub_task_id: "126f8f26-2536-40d6-8166-060f93ada85b"
+```
+
+Refresh `docs/app-data-backup-restore-handoff.md` with the 2026-07-10 custodian
+conformance snapshot, the cluster inventory, and the platform coordination path
+for backup implementation.